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This  study  demonstrated  the  use  of  simulation  mbdelling  to  analyze  Granite 
Sentry  system  performance.  The  availability  simulation  model  constructed  provides  a 
number  of  system  performance  measures  as  a  function  of  component  MTBFs  and 
MTTRs.  Analysis  of  failure  data  prior  to  model  construction  supported  the  generally 
accepted  use  of  exponentially  distributed  failure  rates  and  lognormally  distributed 
repair  times.  A  Microsoft  Windows  version  of  SLAMS YSTEM  proved  to  be  an 
efficient  modelling  tool,  especially  during  early  stages  of  model  development. 
Guidelines  for  model  use  in  system  analysis  are  explored  through  a  runtime  analysis 
and  a  response  surface  model  of  system  downtime  as  a  function  of  part  redundancy. 
The  runtime  analysis  provides  recommendations  for  appropriate  simulation  runtime  and 
number  of  replications  to  produce  reasonably  efficient  and  accurate  results.  The 
response  surface  analysis  highlights  three  system  components  whose  part  redundancy 
significantly  affects  system  downtime.  Finally,  the  analytical  availability  model 
developed  was  an  essential  validation  tool  in  simulation  model  development. 
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A  SIMULATION  APPROACH  TO 


GRANITE  SENTRY  SYSTEM  ANALYSIS 


Z  Introduction 


1.1  Background 

Simulation  modelling  has  been  recognized  as  essential  in  evaluating  system 
performance,  especially  wdien  cost  or  asset  constraints  limit  the  testing  of  actual 
systems  (19;SS3).  One^f-a-kind  systems  pose  especially  stringent  asset  constraints  in 
diat  there  is  goierally  not  a  system  available  for  dedicated,  extensive  testing.  The 
asset  constraints  encountered  wdien  testing  one^f-a-kind  systems  suggest  distinct 
advantages  of  developing  simulation  models  of  these  systems.  Simulation  models  used 
during  testing  could  be  categorized  as  availability  simulation  models  since  one  of  dieir 
primary  purposes  would  be  to  estimate  of  system  performance  measures  related  to,  and 
including  system  availability.  Model  estimation  of  numerous  system  and  component 
level  reliability,  maintainability,  and  availability  (RM&A)  statistics  could  aid  decision 
makers  in  determining  ^stem  limitations,  and  design  configurations. 

1.1.1  Literature  Review.  The  articles  reviewed  below  illustrate  the  use  of 
simulation  modelling  in  system  analysis.  Specifics  of  model  construction  were  system 
dependrat  and  tiierefore  are  not  explained  in  detail.  All  articles  reached  similar 
conclusions  related  to  use  of  simulation  modelling  as  a  tool  in  conducting  ^stem 


analysis— all  researchers  were  avid  supporters  of  simulation  modelling  and  believed 
their  results  were  enlightening  because  of  the  simulation.  In  addition  to  the  examples 
below,  the  Air  Force  Test  and  Evaluation  Center  (AFOTEC)  has  used  simulation  to 
aid  in  determining  system  availability  for  several  systems,  including  F-16s  (9). 

Brown  developed  a  simulation  model  of  Mobile  Satellite  Command  Systems  to 
analyze  endurance  and  availability  (S;3).  His  model  simulates  a  g^eric  system  vdiich 
is  considered  representative  of  all  similar  systems.  The  model  is  sufficiently  flexible 
to  incorporate  varied  system  configurations  and  fully  exploit  sensitivity  analysis  (5:1- 
3).  His  use  of  experimental  design  and  systematic  sensitivity  analysis  is  most  relevant 
to  this  research  effort. 

Pohl  used  a  simulation  model  to  evaluate  F-15E  availability  during  operational 
testing  (19:549).  She  modeled  a  squadron  of  F-lSEs  (24  aircraft)  under  both 
peacetime  and  wartime  scenarios.  Due  to  the  inherent  impossibility  of  testing  under 
wartime  conditions,  and  the  exorbitant  cost  of  testing  an  entire  squadron,  she 
concluded  diat  "Use  of  the  F- IS  Availability  Model  was  essential  to  the  evaluation  of 
F-IS  mission  reliability,  maintainability  and  availability  during  OT&E”(19:SS3). 

Using  this  model,  she  estimated  the  squadron  RM&A  statistics  based  on  test  data  from 
only  two  aircraft  (19:553).  The  ability  to  evaluate  a  system  under  a  wide  range  of 
scenarios  not  possible  dirough  actual  testing  is  one  of  the  major  advantages  of  using 
simulation  in  RM&A  studies. 

Several  researchers  note  advantages  of  simulation  in  their  research.  In  his 
article  on  use  of  simulation  in  availability  calculations,  Schroeder  cites  the  work  of 
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otfier  analysts  (Naylor,  Moore  and  Clinton,  and  Mogendialer)  to  develop  the  following 
list  of  benefits  of  simulation  as  an  analysis  tool. 

Simulation; 

1)  allows  thorough  study  of  complex  interactions  within  a  system. 

2)  is  the  means  to  analyze  effects  of  varying  external  factors  such  as 
environment  and  other  connected  systems  on  system  behavior. 

3)  allows  for  determination  of  critical  variables  and  levels  through  sensitivity 
analysis. 

4)  can  be  used  to  experiment  with  new  situations  that  may  occur  and  about 
vdiich  there  is  little  or  no  collected  information. 

5)  serves  as  a  "no  risk"  test  prior  to  implementation  of  the  system  for  testing 
new  policies  and/or  decision  rules. 

6)  enables  study  of  dynamic  systems  in  compressed  time. 

7)  allows  die  breakdown  of  a  complex  system  into  subsystems  providing  the 
means  for  additional  understanding  and  analysis  of  the  system. 

8)  can  help  predict  bottlenecks  or  weak  points  in  the  system.  (21:746-747) 

Both  Pohl's,  and  Boyd  and  Bavuso's  analyses  add  support  to  Schroeder's 
advocacy  of  simulation.  In  Pohl's  discussion  of  her  model,  she  clearly  states  that 
simulation  was  "essential"  to  evaluating  F-ISE  RM&A  measures  of  performance.  In 
her  report,  she  lists  some  of  die  same  simulation  benefits  as  Schroeder  (19:550). 

Boyd  and  Bavuso  similarly  agreed  that  simulation  is  beneficial  and,  in  fact,  essential 
to  complete  analysis.  They  also  emphasized  a  need  for  co-existing  analytical  tools  that 
are  compatible.  They  stated  these  co-existing  tools  are  necessary  to  give  the  analyst 
sufficient  flexibility  in  conducting  die  analysis  (4:106,  112).  This  thesis  supports  this 
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finding  through  development  of  an  availability  spreadsheet  model  to  be  used  for 
system  analysis  in  addition  to  the  simulation  model. 

Simulation  allows  for  a  thorough  analysis  of  system  performance  under  a 
variety  of  scenarios  and  system  conditions.  A  simulation-based  analysis  can  provide 
great  insight  into  system  performance,  especially  when  extensive  testing  of  actual 
systems  is  not  possible,  making  simulation  a  useful  analysis  tool. 

1.1.2  Model  Requirement.  The  Studies  and  Analysis  division  of  the 
Headquarters  of  the  Air  Force  Test  and  Evaluation  Center  (HQ  AFOTEC/SAL)  plans 
to  use  simulation  more  frequently  in  system  analysis,  especially  during  testing  of  one- 
of-a-kind  systems  (9).  Furdier,  HQ  AFOTEC/SAL  has  been  tasked  to  develop  a 
generalized  availability  simulation  model  for  analyzing  one-of-a-kind  systems.  Since 
construction  of  this  generalized  model  will  likely  require  about  two  years,  AFOTEC 
personnel  suggested  that  developing  an  availability  simulation  model  for  a  specific 
system  could  assist  them  in  completing  their  task  (9).  Additionally,  construction  and 
use  of  an  availability  simulation  model  for  a  specific  system  could  aid  in  evaluation  of 
diat  system. 

1.2  Objectives 

The  purpose  of  this  research  was  to  develop  an  availability  simulation  model  of 
the  Message  Processing  Section  (MPS)  of  Granite  Sentry,  a  computer  system  in  the 
Cheyenne  Mountain  Complex.  The  model  calculates  intrinsic  system  availability, 
including  only  computer  hardware  and  software  component  contributions  to 
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availability.  Additional  model  outputs  include  mean  time  between  critical  failures, 
component  availabilities,  as  well  as  many  other  RM&A  statistics.  This  research  also 
displays  the  capability  and  benefit  of  developing  and  using  an  availability  simulation 
model  in  system  analysis. 

1.3  Background  of  CMU  and  Grcmite  Sentry 

The  false  attack  indications  issued  by  die  defense  system  in  Cheyenne 
Mountain  in  Nov  1979  and  June  1980  caused  great  panic  diroughout  the  nation  (13:3). 
These  events  clearly  demonstrated  die  need  to  upgrade  obsolete  computer  systems  in 
the  Cheyenne  Mountain  Complex  (CMC).  The  Ch^enne  Mountain  Upgrade  (CMU) 
Program  began  in  1981  to  modernize  several  aspects  of  the  CMC  such  as  the 
Communications  Systems  Segmmt  (CSS),  die  NORAD  Computer  System  (NCS),  the 
Mission  Essential  Back-Up  (MEBU),  and  die  Command  Center  Processing  and 
Display  System  (CCPDS)  (13:3).  Granite  Sentry  was  added  to  the  CMU  Program  in 
July  198S  to  improve  a  variety  of  attack  warning  and  assessment  missions  by 
enhancing  computer  systems  that  relay  air  and  missile  warning  messages  from  sensors 
outside  die  CMC  to  the  workcenters  widiin  (13:3). 

The  Granite  Sentry  upgrade  is  a  phased  acquisition  of  both  hardware  and 
software  replacements.  System  enhancements  to  date  include  installation  of  seven 
new  Digital  Equipment  Corporation  (DEC)  VAX  8SS0  computers,  fimctioning  as  the 
main  system  processors,  and  diirty  new  DEC  VAX  3S40  workstations.  The  final 
phase  will  include  additional  hardware  and  software  upgrades  to  fiirdier  improve 
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processing  of  air  and  missile  warning  information  (13:4).  Final  operational  testing  of 
die  Granite  Sentry  system  is  currently  scheduled  to  occur  in  199S  and  will  complete 
the  phased  installation  of  the  system. 

1.4  Granite  Sentry  System  Description 

The  following  sections  describe  die  specific  hardware  and  software  components 
of  die  Granite  Sentry  system  and  their  functional  relationships.  Understanding  these 
relationships  is  essential  to  constructing  a  useful  model. 

1.4.1  Hardware.  Figure  1.1  shows  the  diree  m^or  hardware  components  in 
Granite  Sentry  (GS):  workstation  displ^s,  a  gateway  and  processor  cluster,  and  a 
communications  network.  The  system  has  be«i  designed  with  component 
redundancies  which  are  used  to  increase  hardware  availability.  This  redundancy  is 
important  since  component  availability  is  die  primary  factor  used  in  calculating  system 
operational  status  (13:5). 

Currendy,  there  are  30  DEC  VAX  3540  workstations  located  in  workcenters 
throughout  CMAFB,  although  the  GS  software  can  support  up  to  64.  Workstations 
display  a  processed  version  of  national  defense  air  and  missile  messages  transmitted 
from  sensors  outside  CMAFB  (13:5). 

The  gateway  and  processor  cluster  is  a  group  of  computers  linked  togedier  to 
share  resources  (disk  drives,  storage  devices,  databases).  The  GS  cluster  is  composed 
of  seven  DEC  VAX  8550  processors.  Two  fiinction  as  gateways  for  data  to  enter  and 
exit  Granite  Sentry,  i^ile  five  serve  as  mission  processors  diat  analyze  data  brought  in 
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figme  1.1:  Granite  Sentry  Major  Hardware  Components 


Arough  the  gateway  servers.  After  processing  is  complete,  the  data  is  ready  for 
transmittal  to  the  workstations  via  the  ethemet  (13:5). 

A  dual  rail  ethemet  provides  a  commimication  link  between  all  hardware 
components.  The  ethemet  consists  of  two  separate  data  transmission  lines  nmning  in 
parallel.  The  two  separate  paths  available  for  data  flow  provide  backup  transmission 
capability  diroughout  the  system  (13:6).  Only  one  functional  line  is  necessary  to 
transmit  data  through  die  system. 

1.4.2  Software.  Granite  Sentry  software  is  organized  in  functional  groups 
called  Computer  Software  Configuration  Items  (CSCIs).  The  six  current  CSCIs  in 
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Granite  Sentry  are  Gateway,  Command  Post,  Air  Mission,  Workstation,  System,  and 
Support  (13:6).  Table  1.1  gives  a  brief  description  of  CSCI  functions,  how  they  are 
intercoimected,  and  with  A^^ich  hardware  components  they  are  associated. 

1.4.3  System  Input  and  Output.  Input  to  Granite  Sentry  consists  primarily  of 
messages  containing  national  defense  information  about  air  or  missile  attacks.  Air 
messages  come  into  Granite  Sentry  from  the  Communications  Systems  Segment  (CSS) 
and  relay  direat  information  that  is  of  an  "air  breathing"  nature.  Missile  messages 
come  to  Granite  Sentry  from  die  NORAD  Computer  System  (NCS)  and  transmit 
information  related  to  possible  missile  direats. 

Output  from  Granite  Sentry  is  displayed  on  workstation  video  displays. 

Correct  processing  of  the  "raw"  sensor  messages  and  transmittal  of  this  information  to 
CMC  workcenters  via  dieir  workstations  is  the  mission  of  die  Granite  Sentry  system. 
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CSCI  NAME 


CSCI  FUNCTION 


HARDWARE 

ASSOCIATION 


1  Gateway  CSCI 

provides  the  interface  between  GS  and  the 
sensors;  receives  data  from  die  CSS  and 
NCS,  writes  it  to  a  journal,  and  passes  it 
on  to  the  appropriate  mission  CSCI 

VAX  8550  1 

Command  Post 
CSCI 

handles  message  processing  and 
validation  for  all  missile  warning  data 
from  die  Gateway  CSCI;  processes 
missile  warning  data  manually  input  from 
workstation  keyboards 

VAX  8550 

Air  Mission  CSCI 

handles  all  message  processing  and 
validation  for  all  air  defuse  data  from  the 
Gateway  CSCI;  transmits  messages  back 
to  the  GatewtQT  CSCI  to  be  passed  to  the 
outside  world;  processes  air  defense  data 
input  from  workstation  keyboards 

VAX  8550 

Workstation  CSCI 

displays  processing  for  missile  warning 
and  air  defense  data;  receives  data  from 
both  the  Command  Post  and  Air  Mission 
CSCIs 

VAX  3540 
workstations 

System  CSCI 

provides  "behind-the-sc«ies"  software 
c^abilities  such  as  system  monitoring, 
maintenance  functions,  system  control, 
clock  control,  and  message  journaling; 
most  functions  used  by  all  other  CSCIs 

VAX  8550  and  VAX 
3540  workstations 

Support  CSCI 

provides  data  analysis  and 
exercise/simulation  capabilities;  allows 
user  requests  for  reports  of  all  the 
incoming  and  outgoing  data  from  GS 

■  A  . .  " 

VAX  8550  and  VAX 
3540  workstations 

raUe  1.1:  Granite  Sentry  Software 
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n.  Definitions  and  Model  Assumptions 


2. 1  Definitions 

2.1.1  Reliability.  The  probability  a  system  performs  its  required  mission  (i.e. 
works  for  a  specified  period  of  time)  is  the  system  mission  reliability  (24:1).  Mission 
reliability  is  used  to  describe  systems  functioning  widi  "hot”  backups  that  immediately 
take  over  vdien  the  primary  system  fails  (24:2).  Since  Granite  Sentry  systems  meet 
die  definition  requirements  of  mission  reliability,  reliability  calculated  in  this  thesis  are 
mission  reliabilities. 

Reliability  statistics  can  be  calculated  by  obtaining  failure  information  about 
system  components,  calculating  the  amount  of  time  between  failures  (TBFs),  and 
fitting  diis  data  to  a  distribution.  Parameters  of  diis  lifetime  distribution  describe  the 
failure  rate  of  the  system  i^ich  can  be  translated  to  system  reliability.  Complexity  of 
diese  calculations  occurs  when  system  components  are  both  in  parallel  and  in  series 
and  vdien  failure  of  a  component  does  not  necessarily  translate  to  system  failure  (4:6). 
Granite  Sentry  is  composed  of  a  combination  of  series  and  parallel  structures. 

Failure  rates  can  also  be  calculated  using  die  following  relationship  (12:6). 

Failure  Rate  =  #  failures/Total  Operating  Time 

2.1.2  McdntaincAility .  Maintainability  of  a  system  is  defined  "...as  the 
probability  that,  when  maintenance  is  performed  under  specified  conditions,  the  system 
will  be  up  again  (in  a  state  of  operation)  within  a  specified  period"  (24:10). 
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Maintainability  is  determined  through  calculation  of  the  Time  To  Repair  (TTR)  a 
componmt  after  each  failure.  A  collection  of  TTRs  for  a  specific  component  can  be 
gri4)hed  to  comprise  a  TTR  probability  density  function  for  the  component  The 
parameters  of  this  frequently  lognormal  distribution  describe  the  repair  rate,  and  thus 
determine  the  maintainability  of  die  component  (4;  6). 

2.1.3  Availability.  Combining  reliability  wid  maintainability  measures  yields 
system  availability  which  is  usually  of  primary  interest  to  the  system  user. 

Availability  is  the  probability  die  system  is  able  and  committable  to  performing  its 
required  mission(s)  at  any  random  time.  It  can  be  calculated  by  a  ratio  of  system  "up 
time"  divided  by  total  system  operating  time  ("up  time"  +  "down  time"  )  (12:7). 

Availability  can  also  be  calculated  direcdy  from  the  reliability  and 
maintainability  distribution  parameters  (20:440).  It  is  well  known  that  as  operating 
time  iqiproaches  infinity,  estimations  of  system  or  component  availability  can  be  made 
knowing  only  the  mean  of  die  failure  rate  and  repair  rate  distributions— the  type  of 
distribution  need  not  be  known  (20:441).  This  fact  provides  the  basis  for  availability 
calculations  made  in  the  analytical  model  presorted  in  section  3.3  of  this  thesis 
(20:441). 


Availability  of  a  Series  System  widi  i  components: 

A=n— 

I 


(1) 


where  /t,  =  repair  rate  of  component  i,  and  Xj  =  failure  rate  of  component  i 
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Availability  of  a  Parallel  System  with  i  components: 


^=i-n 

i 


K 


(2) 


For  the  purpose  of  thesis  calculations,  the  term  model  availability  is  used  to 
refer  to  numbers  resulting  from  calculations  using  formulas  1-3  above.  This  ensures 
that  availability  statistics  generated  are  interpreted  as  being  a  direct  result  of  die 
modelling  assumptions  under  i^diich  they  were  created. 


2.2  Model  Assumptions 

2.2.1  System  Structure  Assumptions.  The  following  are  assumptions  related  to 
the  specific  structure  used  in  the  simulation  model. 

1)  The  system  is  modeled  as  the  Initial  Operational  Capability  (IOC)  model,  rather 
dian  the  Final  Operational  Capability  (FOC>  model,  since  information  about  the  IOC 
model  was  most  readily  available.  The  FOC  model  was  still  in  its  planning  stages. 

2)  Redundant  parts  within  components  are  simulated  as  being  accessed  in  numerical 
order,  (eg.  Messages  are  sent  first  to  gateway  hardware  processor  number  1 .  Only  if 
diis  unit  is  down  are  messages  sent  to  die  2nd  processor.)  This  is  a  method  of 
simplifying  the  simulation  model  structure  and  was  verified  as  an  acceptable  model 
assumption  by  Martin  Marietta  personnel  (2). 

3)  All  redundant  parts  are  assumed  to  serve  as  "hot  standby s"~ready  for  immediate 
use.  No  crossover  time  is  modeled  v^en  a  back-up  part  is  used. 

4)  Sub^stems  are  independent—failures  in  one  component  do  not  affect  die  other 
components. 

5)  The  ^stem  is  assumed  to  be  in  continuous  operation. 

6)  Maintenance  resources  are  assumed  to  be  available  in  unlimited  supply  and 
immediately  upon  part  failure. 
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2.2.2  Critical  and  Non-Crirtcal  Failun  Assumptions.  The  following 
assumptions  define  system  failure  classifications. 

1)  Components  for  which  a  failure  does  not  constitute  a  critical  failure  are  not 
included  in  the  model.  Non-critical  components  for  Granite  Sentry  include; 

Miscellaneous  Hardware  (including  printers,  etfaemets) 

Miscellaneous  Sofhvare 

Personnel  who  cause  system  failure  through  procedural  error 

2)  The  critical  path  refers  to  die  minimum  hardware  and  software  components 
required  to  oisure  adequate  message  transmission.  A  critical  feature  is  any  failure  that 
violates  one  of  diese  minimum  requirements.  This  critical  padi,  obtained  from  Martin 
Marietta,  is  composed  of  die  components  listed  in  Table  2.1  (2). 

2.2.3  Other  Assumptions 

1)  The  system  is  not  taken  down  for  training-training  is  completed  off-site. 

2)  Data  saves/back-ups  are  done  while  die  system  is  operational. 

3)  New  software  (except  for  new  operating  systems  which  are  loaded  about  every  two 
years)  is  loaded  while  the  system  is  up. 

4)  All  system  hardware  and  software  components  are  assumed  to  be  running  all  die 
time— no  down  time  other  than  for  repairs. 

5)  Distributions  for  failure  rates  will  be  obtained  from  actual  data  and  are  assumed  to 
already  incorporate  a  "bum-in"  period  therefore  represent  "steady  state"  performance. 
This  "bura-in"  period  is  not  accounted  for  separately  by  the  simulation  model.  Due  to 
the  memoiyless  quality  of  exponential  failure  rates  (which  are  assumed  in  the  model) 
and  the  high  availability  of  components,  it  is  assumed  diat  starting  simulation  runs 
widi  no  failed  components  is  acceptable. 

6)  Scenarios  for  message  flow  (air  and  missile  messages)  are  based  on  general 
statements  made  by  Martin  Marietta  personnel.  Actual  scenarios  used  by  Martin 
Marietta  for  testing  are  classified. 
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COMPONENT  NAME 

CRITICAL 

NUMBER 

Power  Distribution  Unit  (PDU)* 

1  of  2 

Gateway  (DEC  VAX  8SS0) 

1  of  2 

Air  Gatewt^r  Software 

1  of  2 

Mission  Gateway  Software 

1  of  2 

Star  Couplers* 

1  of  2 

HSC  70  Disk  Controllers 

1  of  2 

RA82  disk  drives  (arranged  in  10  shadow  sets 
containing  2  drives  each-l  of  2  must  function) 

8  of  10  shadow 
sets 

Mission  Processors  (DEC  VAX  8SS0) 

1  of  5 

Air  Mission  Software 

1  of  2 

Command  Post  Software 

1  of  2 

Status  Monitor  Software 

1  of  5 

Workstation  hardware 

3  of  6  (ADOC) 

7  of  9  (NCC) 

Workstations  software 

3  of  6  (ADOC) 

7  of  9  (NCC) 

*  indicates  no  failures  have  occurred  to  date 

Table  2.1:  Granite  Sentry  Critical  Components 
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ni  Model  Development 

This  chapter  begins  with  discussion  of  the  background  steps  completed  prior  to 
simulation  model  construction.  Following  diis  background  section  is  a  detailed 
etqtlanation  of  die  Granite  Sentry  simulation  model  in  words  and  diagrams.  The 
chapter  concludes  with  description  of  an  analytical  spreadsheet  model  developed  as  an 
additional  analysis  tool. 

The  following  terminology  is  used  diroughout  discussion  of  the  Granite  Sentry 
models. 

component  -  refers  to  one  of  the  13  critical  components  of  Granite  Sentry  listed  in 
Table  2.1.  (eg.  power  distribution  unit,  gateway,  etc.) 

part  -  smallest  irdependendy  functioning  portion  of  a  component  (eg.  Gateway  1,  SC 
1,  etc.) 

message  processing  -  messages  transmitted  to  Granite  Sentry  from  outside  sensors  are 
subsequendy  "processed”  by  hardware  and  software  components  that  interpret  and 
configure  data  in  a  useful  format  for  Granite  Sentry  operators 

messazes  received  -  messages  successfully  processed  by  a  component  are  considered 
to  be  received  by  that  component;  messages  considered  to  be  received  by  die  system 
have  been  successfully  processed  by  all  system  components 

messages  not  received  -  messages  not  processed  by  a  component  due  to  critical  failure 
of  diat  component  are  considered  as  not  received  by  both  the  part  and  the  system 

The  following  terms  are  used  to  organize  simulation  model  discussions; 

segment  -  portion  of  die  simulation  model  that  performs  a  specific  independent 
function  (eg.  Hardware  Failure  Segment,  Message  Creation  Segment,  etc.) 

section  -  refers  to  segmentation  of  die  simulation  model  based  on  independent  network 
flow—entities  travel  only  within  a  section  (eg.  Air  and  Missile  Message  Processing 
Section,  etc.) 
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3. 1  Background  to  Model  Construction 

This  section  reviews  steps  taken  prior  to  formulation  of  die  Granite  Sentry 
availability  simulation  model.  Extensive  analysis  and  understanding  of  the  system  was 
essential  to  producing  an  accurate  representation  of  the  system  in  the  simulation 
model. 


3.J.]  Determination  of  Model  Requirements.  Model  requirements  were 
determined  through  communication  with  the  contractor,  Martin  Marietta,  and  with 
AFOTEC  personnel  (1,  10,  22).  Discussions  widi  Martin  Marietta  personnel  indicated 
diat  calculation  of  system  availability  was  of  primary  importance.  AFOTEC  also 
suggested  that  die  following  elements,  or  at  least  dieir  possible  effects  on  availability, 
should  be  included  in  an  availability  simulation  model  (10:4): 

1)  Hardware  element 

2)  Software  element 

3)  Human  element 

4)  The  physical  environment-interaction  widi  other  equipment 

5)  Effect  of  sparing  levels  and  maintenance  concepts 

Due  bodi  to  lack  of  time  and  necessary  information,  the  system  as  modeled  in  this 
diesis  only  direcdy  reflects  the  first  two  elements. 

Recommendations  for  model  output  included: 

1)  Mean  Time  Between  Critical  Failures  (MTBCF) 

2)  Mean  Time  to  Repair  (MTTR) 

3)  Intrinsic  Model  Availability 

4)  Mean  Time  Between  Maintenance  (MTBM)  (scheduled  and  unscheduled) 

5)  Mean  and  90di  percentile  hardware  repair  time 


16 


3.1.2  Detenu ination  of  System  Structun  and  Model  Components.  Model 
components  were  determined  dirough  review  of  Martin  Marietta  white  papers  (11,  12) 
and  the  Granite  Sentry  Technical  Support  Manual  (13).  Component  structure  was  also 
obtained  from  diese  sources  and  verified  through  telephone  communication  widi 
Martin  Marietta  personnel  (2). 

Granite  Sentry  is  composed  of  die  13  critical  hardware  and  software 
components  listed  in  Table  2.1.  These  components  function  together  to  process  air 
and  missile  messages  received  from  sensors  outside  CMAFB.  In  addition.  Granite 
Smtry  software  generates  a  type  of  "status  message"  revealing  die  status  of  die  system 
to  its  operators.  Though  transmission  of  diese  status  messages  is  not  critical  to  system 
fimctioning,  lack  of  transmission  indicates  a  failure  of  die  status  monitor  software 
vdiich,  in  turn,  is  considered  a  critical  ^stem  failure.  Accurate  depiction  of  the 
hardware  and  software  components  that  process  air  and  missile  messages  is  the  basis 
of  die  Granite  Sentry  availability  simulation  model. 

3.J.3  Analysis  of  Component  Failures.  Copies  of  the  Joint  Reliability  and 
Maintainability  Evaluation  Team  (JRMET)  Meeting  Minutes,  provided  by  Martin 
Marietta,  contained  failure  data  for  Granite  Soitry  from  September  1991  to  August 
1993.  To  facilitate  analysis,  data  from  1992  was  transcribed  to  a  Microsoft  EXCEL 
spreadsheet  format.  In  die  interest  of  time,  die  1992  sample  was  considered 
sufficiendy  representative  of  most  components;  however,  ail  data  would  have  been 
used  in  the  analysis  if  data  could  have  been  obtained  in  electronic  format.  Appendix 
A  contains  die  spreadsheet  file  of  failures  sorted  by  component  type. 
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3.1.4  Fitting  Failure  Daa  to  Lifetime  Distributions.  An  EXCEL  spreadsheet 
file  containing  all  failure  data  sorted  by  component  facilitated  calculation  of  times 
between  failures  and  times  to  repair.  For  components  whose  failures  were  identified 
by  specific  part  (eg.  workstation  1  hw),  TBFs  were  calculated  for  each  part  and  then 
aggregated  to  develop  a  sample  database.  Parameters  of  distributions  fit  to  diis  sample 
database  characterize  each  part  and  were  used  to  generate  part  failures  in  the 
simulation  model.  TTRs  were  aggregated  in  a  similar  manner  to  develop  a  database 
used  to  fit  distributions  representing  part  TTRs. 

When  failure  data  did  not  include  part  references,  TBFs  were  calculated  for  die 
entire  component  (eg.  Gateway  hw).  Parameters  of  distributions  fit  to  this  data 
characterize  the  component  and  were  transformed  to  yield  parameters  of  the  pan 
failure  distribution  (eg.  Gateway  1)  through  assumption  that  component  failures  can 
be  evenly  distributed  between  the  parts.  In  odier  words,  if  a  component  with  2  parts 
had  8  failures,  then  each  part  was  assumed  to  have  4  failures.  For  exponentially 
distributed  failure  rates,  this  transformation  consisted  of  dividing  the  component  failure 
rate  by  the  number  of  parts,  yielding  a  part  failure  rate.  The  parameters  of  the  part 
failure  rate  distributions  were  used  in  the  simulation  model  to  accurately  represent 
components  as  their  individual  parts  and  not  simply  as  one  big  "black  box". 

Once  the  TBF  and  TTR  databases  for  each  component  were  complete. 

Palisade's  BestFit  software  was  used  to  actually  fit  the  data  to  a  distribution.  The 
specific  procedure  entailed; 

1)  Copying  raw  TBFs  for  a  component  into  a  BestFit  sample  data  file. 
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2)  Displaying  Ae  data  using  die  Input  Distribution  plot  (histogram  format). 

3)  Setting  die  number  of  classes  in  the  histogram  to  the  maximum  diat  allowed 

a  "smooth"  histogram  with  no  empty  intervals-see  Figures  3.1  and  3.2. 

4)  Invoking  BestFit's  distribution  fitting  algorithm— see  Figure  3.3. 

5)  Collecting  statistics  on  raw  data  and  Lack  of  Fit  tests  for  the  fitted 

distributions. 

6)  Selecting  a  "best"  distribution  type  to  represent  the  TBFs  or  TTRs  based  on 

comparison  of  Kolmogorov-Smimov,  Anderson-Darling,  and  Chi-Square 
statistics. 


Input  Distribution 


Figure  3.1:  Unacceptable  Histogram- 
Empty  Intervals 


Input  Distribution 


Values  In  10“1 


Figure  3.2:  Acceptable  Histogram-NO 
Empty  Intervals 


Comparison  of  Input  Distribution  and  Expon(94.05) 


Figure  33:  BestFit  Comparison  of  Sample  Data  to  a  Fitted 
Distribution 
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3. 1.4. 1  Lack  of  Fit  Tests.  Bestfit  presents  rankings  of  the  fitted 
distributions  based  on  three  goodness-of-fit  tests:  Chi-Square,  Kolmogorov-Smimov, 
and  Anderson-Darling.  These  tests  are  briefly  described  below. 

The  OdStpime  Test  "measures  how  well  the  sample  data  fit  a  hypothesized 
probability  density  function"  (17:23).  This  is  a  test  based  on  "...a  comparison  of 
observed  cell  counts  widi  dieir  expected  values  under  the  hypothesis  . ."(6:63)  By 
making  diis  type  of  cell  count  comparison,  diis  test  ignores  some  information 
contained  in  the  data  making  it  "less  powerful"  dian  other  tests  in  some  situations. 

The  Chi-Square  test  has  wide  applicability  because  of  its  generalized  approach,  but 
sensitivity  to  dioice  of  cell  size  renders  it  inappropriate  for  small  samples  (14:82). 

The  KolmogmovSmimav  Test  (K-S  Test)  compares  "...an  empirical 
distribution  fimction  widi  the  distribution  of  die  hypothesized  function"(  17:23).  It 
measures  die  vertical  distance  between  a  step  function  created  by  the  sample  data  and 
the  hypothesized  distribution.  The  test  statistic  is  calculated  based  on  the  largest 
observed  vertical  distances  betweoi  the  two  distributions  (6:100). 

The  Anderson-DmUttg  Test  (A~D  Test)  is  "...designed  to  detect  discrepancies  in 
die  tails  of  the  distributions"(17:23).  Similarly  to  die  K-S  statistic,  it  measures  the 
differences  between  die  empirical  and  hypothesized  cumulative  distributions,  but  the 
differences  are  squared  in  calculation  of  the  A-D  test  statistic.  Calculation  of  the  A-D 
test  statistic  also  includes  a  weighting  function  diat  assigns  larger  weights  to 
differences  obtained  from  comparison  of  the  tails  of  the  distributions  (6:100). 
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For  this  analysis,  results  of  tfie  Chi-Square  test  are  sufficient  to  select  a 
representative  distribution  where  sample  sizes  are  large  (workstation  hardware  and 
software  failures).  For  the  other  components,  \^ose  failure  data  was  limited,  the  K-S 
and  A-D  tests  are  more  appropriate  since  these  test  statistics  do  not  depend  on 
assignment  of  sample  values  to  histogram  ceil  counts  (14:81-83).  Additionally,  since 
diis  research  involves  coarse  estimation  of  failure  and  repair  distributions,  die  K-S  test 
will  be  preferred  to  the  A-D  test.  Since  the  calculation  of  K-S  test  statistics  does  not 
involve  adding  extra  weight  to  die  tails  of  die  distribution,  the  K-S  test  appears  more 
appropriate  for  coarse  distribution  estimation. 

3. 1.4.2  Bestfit  Results.  A  summary  of  Bestfifs  selected  distributions, 
their  parameters,  and  goodness-of-fit  test  statistics  are  listed  by  component  in 
Appendix  B.  Test  statistics  revealed  that  die  general  assumption  of  exponentially 
distributed  failure  rates  is  not  unreasonable.  When  the  exponential  distribution  did  not 
have  die  best  fit,  die  parameters  of  the  better  fitting  gamma  or  weibull  distribution 
rendered  their  distribution  approximately  exponential.  Similarly,  values  of  K-S  test 
statistics  for  distributions  chosen  as  best  fits  to  die  TTR  data  revealed  that  the 
assumption  of  lognormally  distributed  failure  times  was  not  unreasonable. 

3.2  Availability  Simulation  Model  Construction 

Model  requirements,  ^stem  structure,  and  component  characteristic 
distributions  were  the  basis  for  developing  the  availability  simulation  model. 

Subsection  headings  below  oudine  the  general  process  used  to  develop  the  final  model. 


3.2.1  Initial  Simulation  Model  Construction.  A  Microsoft  Windows  version  of 


SLAMSYSTEM  was  used  to  construct  an  initial  simulation  model  of  the  system  In 
many  ways,  this  method  of  network  coding  was  very  efficient.  The  pictorial,  menu- 
driven  mediod  of  model  construction  allowed  a  focus  on  correctly  modelling  the 
system  structures  rather  dian  on  coding  details.  Similarities  between  die 
representation  of  different  model  components  allowed  for  extensive  use  of  block 
copying.  Additionally,  having  a  pictorial  representation  of  die  physical  system  to  refer 
to  in  model  validation  was  extremely  useful.  Tracking  oitity  flow  along  a  picture  is 
generally  easier  dian  tracking  entity  flow  through  program  code. 

Because  of  similarities  in  component  structures,  model  construction  was 
completed  in  segments,  with  many  segments  repeated  extensively  throughout  the 
model.  Explanation  of  die  network  will  follow  a  similar  segmented  approach.  To 
begin  with  ,  the  network  is  divided  into  three  main  sections.  These  sections  are 
referred  to  as  die  Air  and  Missile  Message 
Processing  Section,  die  Status  Message 
Processing  Section,  and  the  Time-Based 
Random  Failure  Generation  Section.  Block 
diagrams  at  die  beginning  of  each  section 
depict  the  general  processes  conducted 
within  the  section.  Within  sections, 
segmentation  occurs  and  is  described  in 
detail.  SLAMSYSTEM  diagrams  of  each 
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SLAM  NETWORK  SYMBOLS 

Create  Node 

o 

Go  On  Node 

C=D 

Assign  Node 

CJD 

Open  Node-opens  a  gate 

CD 

Close  Node-doses  a  gate 

OD 

Colled  Node 

Terminate  Node 

— 

Activity 

o 

Intermediate  Steps 

Figure  3.4:  SLAM  Network 
Symbols 


t 


s^ment  are  included  to  facilitate  understanding  of  segment  processes.  Figure  3.4 
defines  the  standard  SLAM  symbols  used  to  diagram  the  segments. 

A  ir  end  Missile  Message  Pwcessinf  Section 
This  section  contains  all  die  hardware  and  software  components  required  to 
process  eidier  air  or  missile  m^sages.  These  compements  include  all  system  critical 
components  except  for  die  status  monitoring  software.  This  section  of  die  network 
was  created 


diagram  oudining  the  basic  processes  represented  in  this  section. 

Segment  1:  Message  Creation 

The  air  and  missile  messages  transmitted  to  Granite  Sentry  from  sensors 
outside  CMAFB  are  simulated  as  SLAM  entities.  The  lengdi  of  time  between  creation 
of  message  entities  is  based  on  unclassified  generalizations  of  message  flow  rates 
obtained  from  Martin  Marietta  (1).  Actual  testing  scenarios  are  classified  and  were 
not  obtained  or  used. 
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upon  creation,  message  entities  are  assigned  a  1  or 


2  to  attribute  2  defining  it  as  either  an  air  or  missile 
message.  The  i^iper  create  node  in  Figure  3.6 
corresponds  to  air  messages;  die  lower  to  missile 
messages.  After  die  message  entity  passes  through  an 
activity,  counters  are  incremented  to  add  up  the  total 
number  of  air  and  missile  messages  created.  From  these 
assign  nodes,  message  entities  are  passed  to  a  go-on  node  which  simulates  the  "door" 
to  Granite  Smtry.  Once  the  message  entities  pass  dirough  this  node  diey  are 
processed  by  die  appropriate  Granite  Sentry  system  components. 

Segment  2:  Component  Representation 

This  segment  is  used  to  represent  all  system  components  in  this  section.  As 
seen  in  Figure  3.7,  the  segment  starts  with  a  go-on  node  with  the  number  of  emanating 
activities  equal  to  the  number  of  component  parts  plus  one.  These  activities  are 
conditioned  on  the  status  of  gates  that  represent 
part  availabilities.  When  the  gate  is  open  the  part 
is  working  and  message  entities  can  flow  through 
that  activity.  Message  entities  arriving  at  the  first 
go-on  node  will  choose  the  first  open  activity, 
checking  them  in  sequential  order  (see  NOTE 

below).  After  passing  dirough  die  activity,  the  message  entity  arrives  at  a  collect 
node  which  tallies  the  number  of  messages  processed  by  that  part. 


Figure  3.7:  Component 
Representation 


Figure  3.6:  Air  and 
Missile  Message 
Creation 
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If  tfie  component  is  experiencing  a  critical  failure,  no  parts  are  functioning  and 
all  gates  are  closed.  If  all  gates  are  closed,  message  entities  are  sent  to  a  collect  node 
tallying  all  messages  not  processed  by  diis  system  component.  It  is  assumed  that 
messages  must  be  transmitted  immediately  upon  receipt  widi  no  delay  acceptable.  In 
reality,  die  message  would  have  been  logged  in  die  computer  journal  and  could  be 
received;  however,  doing  so  requires  replay  of  the  tapes  covering  message  flow  during 
the  time  period  die  system  was  down,  which  is  not  done  in  practice  (2).  All  messages 
successfully  processed  by  this  component  are  passed  to  the  next  component  for 
processing.  Twelve  of  diese  segments  exist  in  the  model. 

NOTE;  In  all  cases,  message  entities  start  "checking”  gates  in  numerical  order, 
checking  the  gate  for  die  second  part  only  if  the  first  part  gate  is  closed.  This 
branching  protocol  is  a  simulation  modelling  convenience  and  does  not  necessarily 
refer  to  actual  labels  of  physical  components. 

Time-Based  Random  Failure  Generation  Section 

This  section  generates  all  failures  observed  in  the  system.  (The  only 
exceptions  are  message-based  failures  occurring  in  the  Status  Monitor  Software 
Segment;  however,  diese  failures  never  actually  occur  in  model  runs  because  no  input 
data  for  distribution  of  diese  failures  was  available.)  The  block  diagram  representing 
basic  failure  simulation  is  shown  in  Figure  3.8. 

Segment  I:  General  Time-Based  Part  Failures 

This  segment  is  the  heart  of  the  gate  system  and  is  used  to  activate/deactivate 
parts  of  die  system  based  on  simulated  failures.  This  segment  generates  failures  for 


25 


Figure  3^:  Time-Based  Random  Failure  Generation  Section 

one  part  of  a  component  (eg.  gateway  1).  Failure  rates  and  MTTRs,  calculated  as 
indicated  in  section  3.1.3,  are  the  basis  for  failure  entity  creation  and  failure  durations 
in  Ais  segment.  Figure  3.9  diagrams  die  segment. 


At  time  zero  one  failure  entity  is  created.  It  first  travels  along  an  activity  to  a 
go-on  node  where  the  failure  simulation  process  begins.  From  the  go-on  node,  the 
failure  entity  travels  along  an  activity  for  an  exponentially  distributed  amount  of  time 
Avith  a  mean  equal  to  die  parameter  of  the  failure  rate  distribution  for  that  part.  Once 
the  failure  passes  through  this  activity,  it  causes  die  first  part  failure.  The  failure 
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entity  tfien  passes  tfirough  an  assign  node  activating  counters  for  part  failures  and  total 
system  hardware/software  failures.  Additionidly,  at  this  assign  node,  a  failure  duration 
is  randomly  generated  and  assigned  to  the  failure  entity  as  an  attribute.  After  passing 
dirough  the  assign  node,  the  failure  entity  sent  along  one  of  two  paths  depending  on 
whether  a  component  critical  failure  has  occurred. 

If  a  component  critical  failure  has  not  occurred,  die  failure  entity  passes 
dirough  a  go-on  node  and  closes  the  part  gate.  After  closing  die  gate,  it  passes  along 
an  activity  of  duration  equal  to  the  time  to  repair,  and  dien  re-opens  the  part  gate.  The 
failure  entity  then  passes  through  an  assign  node  vdiich  decrements  die  counter  for 
current  component  part  failures.  Upon  leaving  die  assign  node,  the  failure  entity  is 
cloned  into  entities  A  and  B.  Entity  A  eidier  travels  to  a  collect  node  and  then  to 
open  the  system  critical  failure  gate,  if  appropriate,  or  is  just  collected.  In  either  case 
Entity  A  ends  up  being  terminated.  Entity  B  is  recirculated  back  to  the  first  go-on 
node  to  represent  die  next  part  failure.  Recirculation  of  failure  entities  was  necessary 
to  avoid  creation  of  first  failures  for  all  parts  at  time  zero. 

If  a  component  critical  failure  has  occuired,  the  failure  entity  passes  dirough  a 
collect  node  counting  critical  component  failures.  Next,  the  failure  entity  is  cloned 
into  entity  1  and  2.  Entity  1  passes  through  the  system  critical  failure  collect  node, 
closes  the  system  critical  failure  gate,  and  is  subsequently  terminated.  Entity  2  passes 
through  an  assign  node  i^ere  attribute  4  is  assigned  a  value  marking  the  failure  entity 
as  a  critical  failure.  From  here  die  failure  entity  is  sent  to  close  the  part  gate  and 
continues  to  be  processed  as  outlined  above  when  a  component  critical  failure  has  not  occurred. 
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Segment  2:  RA82  Failures 

As  observed  in  Figure  3.10,  RA  82  disk  drives  are  structured  differently  than 
any  other  m^or  component.  There  are  20  disk  drives  paired  into  10  shadow  sets  In 
other  words,  2  disk  drives  operate  in  parallel,  and  as  long  as  one  of  these  two  drives  is 
operational,  die  shadow  set  is  considered  functional.  Additionally,  8  of  the  10  shadow 
sets  must  be  functional  at  any  one  time.  Less  than  8  functional  shadow  sets  represoits 
a  system  critical  failure.  Failures  in  diis  segment  represents  failure  of  an  entire 
shadow  set. 


first  pass  through  a  go-on  node  and  then  through  an  activity  of  exponential  duration 
with  a  mean  equal  to  the  parameter  of  the  failure  rate  distribution  for  one  shadow  set. 
The  failure  entity  dien  activates  counters  for  total  system  hardware  failures,  total  RA82 
failures,  and  current  RA82  failures.  After  incrementing  the  counters,  die  failure  entity 
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am  take  one  of  two  paths  depending  on  whether  a  component  critical  failure  has 
occurred. 

If  a  componait  critical  failure  /tor  occurred,  meaning  that  more  than  2  shadow 
sets  have  failed,  die  entity  passes  dirough  a  collect  node  that  tallies  die  number  of 
RA82  critical  failures.  Next,  die  failure  entity  is  cloned  forming  entities  1  and  2. 

Entity  1  passes  through  die  system  critical  failure  collect  node,  closes  the  system 
critical  gate,  and  is  subsequendy  terminated.  Entity  2  closes  the  component  gate  and 
is  assigned  a  value  to  attribute  4  marking  it  as  a  critical  failure.  From  here,  entity  2 
rejoins  die  non-critical  failure  processing  loop  at  die  second  go-on  node  and  is 
processed  as  described  in  die  next  paragraph. 

If  die  component  critical  failure  has  not  occurred,  the  failure  entity  passes 
along  an  activity  to  the  second  go-on  node.  The  failure  entity  leaves  die  go-on  node 
along  an  activity  widi  duration  equal  to  die  lengdi  of  the  failure  stored  in  its  attributes. 
Once  die  failure  is  over,  die  failure  entity  passes  dirough  an  assign  node  causing  die 
current  failure  counter  to  be  decremented.  From  here,  the  entity  is  cloned  into  aitides 
1  and  2.  Entity  1  returns  to  die  first  go-on  node  to  begin  die  next  shadow  set  failure. 
Entity  2  is  passed  to  the  next  go-on  node.  From  die  go-on  node,  entity  2  takes  at  most 
two  of  diree  padis.  If  die  failure  was  a  system  critical  failure  and  the  component  is 
now  functional,  die  entity  takes  two  paths.  The  two  paths  enable  it  to  simultaneously 
travel  dirough  a  collect  node  to  open  die  system  critical  failure  gate  and  to  open  the 
component  part  gate.  If  the  failure  was  not  critical,  die  entity  is  collected  as  a  non- 
critical  failure  and  then  terminated. 
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Segment  3:  Workstation  Failures 

In  Figure  3.11,  die  top  create  node  represents  creation  of  a  workstation 
hardware 
failure  entity, 
the  bottom 
create  node 
represents 
creation  of  a 

software  failure  entity.  The  combination  of  diese  create  nodes  therefore  represents 
one  workstation.  Additional  workstations  are  simulated  by  adding  another  create  node 
feeding  into  the  each  of  the  first  go-on  nodes. 

As  in  previous  failure  segments,  one  entity  is  created  by  each  create  node.  It 
passes  through  a  go-on  node,  and  then  travels  along  an  activity  of  exponential 
duration.  After  passing  through  this  activity,  attribute  2  is  assigned  a  1  or  2  defining 
die  failure  as  eidier  a  hardware  or  software  failure.  Additionally,  at  diis  assign  node 
counters  for  workstation  hardware  and  software  failures  as  well  as  for  current 
component  failures  are  incremented.  From  here,  both  types  of  failure  entities  travel  to 
die  same  go-on  node  and  are  subsequendy  processed  along  die  same  node  sequence. 

Flow  from  die  second  go-on  node  in  this  segment  follows  exactly  as  described 
in  the  RA  82  failure  section,  starting  v^en  RA  82  failure  entities  leave  the  first  assign 
node.  The  only  difference  is  die  number  of  concurrent  failures  causing  a  component 


Figure  3.11:  Workstation  Failures 


critical  failure. 


Status  Message  Processine  Section 

This  section  simulates  die  status  monitor  software  and  its  failures.  The 
message-based  failure  segment  found  in  this  section  is  included  as  a  demonstration  of 
the  capability  to  include  diis  type  of  failure;  however,  since  no  data  was  available  to 
simulate  message-based  failures,  message-based  failure  gates  remain  open  diroughout 
die  simulation.  If  desired, 
this  segment  could  be 
added  to  any  of  the 
software  component 
representations.  Figure  3.12 
gives  an  overview  of  die 
processes  involved  in  this 
section. 

Segment  1:  Status  Message  Creation 

Message  entities  are  created  here  exactly 
as  in  the  air  and  missile  message  creation 
segment.  The  time  between  creation  was  set  to  a 
constant  (10  minutes)  as  recommended  by  Martin  Marietta  personnel  (1).  The  assign 
node  contains  a  counter  diat  totals  the  number  of  status  messages  sent. 

Segment  2:  Messoge-Based  Fcalures 

This  section  includes  the  addition  of  a  second  set  of  failures  caused  by  message 
receipt  wdiich  are  the  basis  of  diis  segment.  It  seems  likely  diat  a  majority  of  software 


Figure  3.13:  Status 
Message  Creation 


Figure  3.12:  Status  Message  Processing  Section 
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failures  would  occur  and  be  recognized  at  die  time  of  message  receipt.  In  other 
words,  unless  the  software  is  actually  accessed,  failures  are  not  likely  to  be  recognized. 
To  account  for  such  a  failure  mode,  this  segment  incorporates  a  second  software 
failure  distribution  based  on  message  flow  rather  than  time.  However,  with  no  data 
available  to  approximate  such  a  distribution,  these  message-based  failures  never 
actually  cause  part  failures  to  occur. 

The  only  difference 
between  message-based  and 
time-based  failures  is  in  failure 
initialization.  Since  the  failure 
is  message-based,  it  occurs  based  on  the  approaching  message's  time  of  creation.  If 
the  time  of  message  entity  creation  is  at  or  beyond  a  randomly  generated  time  for  first 
message-based  part  failure,  the  message  entity  moves  through  an  assign  node  and  then 
closes  the  part  gate  (if  it  is  not  already  closed  due  to  a  time-based  failure).  The  entity 
thoi  passes  through  an  activity  with  duration  equal  to  the  lognormally  distributed 
repair  time,  opens  the  part  gate  (unless  a  time-based  failure  is  still  occurring),  and  is 
terminated.  If  the  time  of  message  entity  creation  is  before  the  time  set  for  the  first 
message-based  part  failure,  the  message  entity  is  considered  processed  and  is  counted 
and  terminated. 

Segment  3:  Status  Monitor  Software 

This  segment  is,  out  of  necessity,  a  combination  of  the  above  message-based 
failure  segment  and  the  component  representation  segment  from  the  air  and  missile 
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Figure  3.14:  Message-Based  Failures 
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message  section.  Each  part  of  diis  component  experiences  both  message-based  and 
time-based  failures.  Message  entities  passing  through  this  segment  check  the  status  of 


the  part  gate.  If  the  part  gate  is  open,  die  entity's  time  of  creation  is  compared  with 
die  time  randomly  selected  for  the  first  message-based  part  failure.  If  die  entity's  time 
of  creation  is  before  the  time  selected  for  the  first  message-based  failure,  the  message 
oitity  is  processed  by  diat  part.  On  die  other  hand,  if  the  part  gate  is  open  but  the 
entity's  time  of  creation  is  at  or  beyond  die  time  selected  for  die  first  message-based 
failure,  the  entity  is  cloned.  The  original  entity  checks  the  remaining  part  gates  and 
attempts  to  be  processed  by  another  part  of  die  component.  If  the  message  entity  does 
not  find  a  part  with  an  open  gate  it  is  collected  as  not  processed  and  terminated. 
Simultaneously,  the  clone  of  the  entity  represents  the  first  message-based  failure  and 
as  such  follows  the  message-based  failure  segment  flow  as  oudined  above. 

3.2.2  Model  Translation  to  SLAM  II  Code.  Limitations  of  the  DOS  version  of 
SLAMSYSTEM  such  as  a  maximum  of  2S  gates  and  SO  collect  nodes  required  that  the 
SLAMSYSTEM  model  be  split  into  two  networks  diat  could  run  independently.  To 
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circumvent  tiiese  limitations,  the  model  was  converted  to  SLAM  II  code  that  could  be 
run  on  a  mainframe  computer.  The  SLAM  model  code  was  extracted  from  the 
SLAMSYSTEM  network  and  control  files  and  merged  into  one  file  using 
WORDPERFECT  as  a  file  editor.  The  resulting  file  contained  useable  SLAM  II  code 
which  ran  widiout  error  after  electronic  transfer  to  mainframe  computers  at  the  Air 
Force  Institute  of  Technology.  However,  after  cursory  review  of  the  code, 
SLAMSYTEM's  disregard  for  a  clearly  organized  structure  was  noted  and  die  code 
was  reorganized  into  die  logical  sequence  presoited  in  Appendix  D.  Reorganization 
allowed  for  collocation  of  related  sections  and  addition  of  explanatory  conunents. 

This  detailed  review  of  die  code  revealed  a  few  hidden  errors  that  were  corrected  and 

ted  inclusion  of  additional  methods  of  information  collection. 

3,2.3  Model  Verification/Validation.  Determination  of  valid  system 
representation  was  accomplished  through  telephone  conversation  with  Martin  Marietta 
persoimel  both  after  die  initial  model  was  built  and  after  the  SLAM  II  version  was 
created  (2).  Additional  model  validation  was  completed  by  comparing  system 
performance  measure  estimates  from  simulation  runs  with  estimates  calculated  with  die 
analytical  availability  model  described  in  section  3.3. 

Initial  model  construction  was  completed  using  equal  failure  rates  and  failure 
durations  for  all  component  parts.  This  essentially  made  all  components  widi  die  same 
number  of  parts  fimction  identically.  Comparing  die  numbers  of  failures  per  part,  the 
numbers  of  messages  processed,  and  other  information  collected  allowed  for  basic 
verification  of  die  model  structure  and  entity  flow. 
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Once  tfiese  test  mottels  seemed  to  function  appropriately,  failure  rates  and 
repair  times  r^resentative  of  actual  system  components  were  input.  Review  of  results 
from  dtese  simulation  runs  allowed  for  detection  of  any  indications  of  model 
misr^resentation.  The  extensive  use  of  global  variables  and  collect  nodes  found  in 
the  model  structure  are  a  direct  result  of  model  verification  procedures. 

3.2.4  FimU  SLAM  II  Model  Development.  After  initially  adapting  die 
SLAMSYSTEM  model  to  SLAM  n  code,  a  reexamination  of  die  ou^ut  requirements 
resulted  in  addition  of  several  global  variables  used  as  counters  for  hardware,  software, 
and  system  critical  failures.  Additionally,  a  gate  was  added  that  op«is  and  closes 
based  on  system  critical  failures  to  provide  for  direct  calculation  of  model  availability. 
Widi  diese  additions,  the  simulation  model  was  considered  ready  for  use  in  system 
analysis. 

3.3  Analytical  Model  Construction 

An  analytical  availability  model  of  Granite  Sentry  was  built  as  a  tool  for 
simulation  model  validation.  Model  construction  was  based  on  standard  availability 
formulas  for  parallel  and  series  ^sterns  widi  repair  (20:440-444).  The  basic  equations 
used  to  calculate  component  and  model  availabilities  are  described  in  section  2.1.3. 

The  model  was  implemented  in  ^readsheet  format  to  facilitate  variation  of  input 
parameters. 

Construction  of  the  model  followed  directly  from  the  simulation  model 
structure.  The  same  model  components  were  included  and  the  system  was  structured 
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with  all  components  functioning  in  series.  Model  availability  calculations  were  based 
entirely  on  die  means  of  the  failure  rate  and  repair  time  distributions  obtained  from 
failure  data  analysis  (20:441).  The  model  spreadsheet  is  included  as  Appendix  D 
Calculation  of  model  availability  began  with  estimation  of  availabilities  for 
eadi  part.  Part  availabilities  were  combined  into  an  overall  component  availability. 
Component  availabilities  were  then  multiplied  togedier,  since  components  are  modeled 
in  series,  resulting  in  overall  model  availability.  Construction  of  the  model,  once 
availability  formulas  were  understood,  took  only  a  few  hours,  a  small  fraction  of  the 
time  needed  to  build  the  availability  simulation  model.  This  type  of  quick  model 
availability  estimation  technique  could  be  particularly  useful  in  early  stages  of  system 
testing. 
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/K  Guidelines  for  Model  Use 

Usually,  simulation  models  are  constructed  to  help  answer  specific  questions 
about  system  performance.  In  this  case,  AFOTEC  simply  requested  an  availability 
simulation  model  for  Granite  Sentry  without  posing  any  specific  system  performance 
questions.  This  chapter,  dierefore,  presents  guidelines  for  model  use  based  on  possible 
areas  of  interest.  First,  a  simulation  runtime  analysis  provides  a  basis  for  determining 
die  runtime  and  number  of  replications  needed  to  produce  simuliUion  results  diat  are 
largely  free  of  initialization  bias  and  have  sufficimdy  small  estimates  of  standard 
error.  Second,  a  response  surface  mediod  (RSM)  approach  could  be  used  to  explore 
any  system  performance  measure  as  a  function  of  model  input  parameters.  To 
illustrate  die  method,  RSM  techniques  are  used  to  explore  system  downtime  as  a 
function  of  part  redundancies. 

4.1  Runtime  Analysis 

When  a  simulation  model  is  used  to  perform  system  analysis,  selection  of 
runtime  and  number  of  replications  can  significantly  impact  analysis  results.  Since 
component  failures  and  repair  times  are  generated  by  random  variables,  the  output  is 
also  a  random  variable  and  as  such  yields  only  an  estimate  of  system  performance 
(24:97).  The  inherent  randomness  of  simulation  output  clearly  suggests  the  need  to 
consider  performing  multiple  replications. 
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When  questioned  about  appropriate  simulation  nmtime,  analysts  at 
AFOTEC/SAL  suggested  a  runtime  estimate  of  20-2S  times  longer  than  the  longest 
MTBF  contained  in  the  model  (9).  Though  they  had  no  concrete  basis  for  this 
estimate,  their  suggestion  could  be  interpreted  to  correlate  with  Nelson's  runtime 
recommendation  of  "...much  longer  than  the  initial-transient  period  (s^  20  times 
longer  to  be  concrete)"  (16:13).  The  initial-transioit  period  Nelson  refers  to  is  the 
amount  of  time  it  takes  for  die  simulation  to  reach  a  steady-state.  Though  this 
simulation  model  assumes  steady-state  failure  and  repair  rates,  the  completely 
operational  state  of  die  system  at  simulation  start  indicates  a  possible  initialization 
bias.  For  an  availability  simulation  model.  Nelson's  initial-transient  period  could  be 
defined  as  the  longest  MTBF  in  the  system  wdiich  would  lead  to  the  same  runtime 
estimate  recommended  by  AFOTEC.  The  following  analysis  attempted  to  provide 
additional  insight  into  an  appropriate  tradeoff  between  die  level  of  simulation  effort, 
defined  by  the  runtime  and  number  of  runs,  and  die  precision  of  the  estimated  system 
performance  measures  for  an  availability  simulation  model. 

4.1.1  Procedures.  The  selection  of  runtimes  used  for  comparison  in  the 
analysis  began  with  AFOTEC/SAL's  recommendation  of  20  times  longer  than  the 
longest  MTBF(3).  The  longest  MTBF  for  any  Granite  Sentry  component  is 
qiproximately  250,000  minutes.  Thus,  die  initial  estimate  of  {qipropriate  runtime  was 
20  times  250,000,  or  5  million  minutes.  Since  a  runtime  less  dian  the  longest  MTBF 
allows  litde  chance  for  caty  failure  of  that  component  to  occur,  the  shortest  runtime  for 
die  analysis,  2  million  minutes,  was  arbitrarily  chosen  to  be  between  250,000  and  5 
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million  minutes.  Three  other  runtimes  of  10,  20  ,  and  30  million  minutes  were 
chosen  to  expand  the  range  of  times  for  comparison.  This  range  simulates  system 
uptimes  between  4  and  57  years  udiich  was  considered  wide  enough  to  observe  any 
runtime  effect  on  estimation  of  system  performance  measures. 

The  variability  of  system  performance  measure  estimates  is  largely  controlled 
through  the  number  of  replications.  In  his  article  on  Designing  Efficient  Simulation 
Experiments,  Nelson  suggests  the  number  of  rqslications  should  be  "...at  least  2,  and 
10  or  more  if  possible"  (23  :128).  In  keeping  with  Nelson's  recommendation  and 
reasonable  amounts  of  computer  time,  10  runs  were  completed  for  each  selected 
analysis  runtime.  Data  collected  from  each  of  die  test  runs  included  total  system 
critical  downtime  and  total  number  of  system  critical  failures-two  measures  of  system 
performance. 

Prior  to  data  analysis,  system  downtimes  and  numbers  of  critical  failures  were 
converted  to  rates  per  million  minutes  of  runtime  (1.9  years)  as  means  to  compare 
results  across  runtime  groups.  For  example,  if  die  system  experienced  S  critical 
failures  during  a  runtime  of  5  million  minutes,  the  result  was  translated  to  1  failure  in 
1  million  minutes.  System  downtimes  were  similarly  translated.  Translated  results  are 
listed  in  Appendices  F.l  and  F.2. 

The  runtime  analysis  that  follows  is  based  on  the  calculation  of  means  and 
variances  for  each  runtime  groiqi.  For  each  group,  a  mean  and  variance  was 
calculated  for  averages  of  two  to  ten  observations.  For  the  two  run  average,  results  of 
die  first  two  experimental  runs  were  averaged.  For  the  diree  run  average  results  of  the 
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first  three  runs  were  used,  and  so  on  up  to  the  10-run  average.  Variances  were  also 
calculated  for  the  same  groups  of  data  as  estimates  of  th  '  population  variance  for 
averages  of  the  same  number  of  runs.  Based  on  these  basic  mean  and  variance 
calculations,  the  following  three  plots  were  constructed  to  analyze  the  data  for  each 
runtime  group.  The  acronyms  listed  in  parentheses  are  used  to  refer  to  the  plots  in  the 
analysis  discussions. 

1)  One  Sigma  Confidence  Intervals  on  the  Meats  (CIM)  plots  depict  one 
sigma  confidence  intervals  around  die  means  for  batch  sizes  between  2  and  10  runs  for 
each  runtime  group.  The  sample  variance  (s^  )  for  each  batch  size  estimates  the 
population  variance  (o^  ).  Since  s^  is  an  estimate  of  the  variance  for  each  random 
obsb  vadon,  the  standard  error  of  the  mean  (se)  is  calculated  as 

%  *  =  4  (I) 

where  Xbar  =  average  of  n  observations  of  a  system  performance  measure 
s  =  standard  deviation  of  the  population 
n  =  number  of  replications  averaged 

2)  95  Percent  Confidence  Interval  (Cl)  plots  display  the  effect  of  incr<^asing 
replications  on  the  standard  error  of  the  mean  for  10  to  30  replications.  The  sample 
means  and  variances  for  10-run  batch  size  were  used  in  lieu  of  actual  means  and 
variances  for  greater  than  10  replications  due  to  time  constraints.  (For  the  30MMR 
group  alone,  it  required  S  days  on  the  VAX  to  process  the  10-run  sample.  )  The 
confidence  intervals  were  calculated  under  the  assumption  diat  these  10-run  means  and 
variances  are  adequate  estimates  of  the  population  parameters  for  downtime  per 
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million  minutes.  Ninety-five  percent  confidence  interval  limits  are  calculated  as  in 
equation  2  with  n  equal  to  die  batch  size. 

mean.Q  —  —  *  (2) 

”  - 

vdiere  meanjo  =  10-run  mean  for  each  runtime  group 
Sio  =  10-run  standard  deviation 

3)  Standard  Error  of  the  Difference  (SED)  plots  reflect  9S  percent  confidence 
intervals  for  the  difference  between  two  sample  means  obtained  from  runs  made  with 
different  system  configurations.  These  plots  again  use  die  10-run  estimate  of  standard 
error  to  calculate  die  standard  error  of  die  difference.  Ninety-five  percent  confidence 
limits  are  calculated  using  die  estimates  of  die  standard  error  of  the  difference  (sed)  as 
calculated  in  equation  3.  Note  diat,  for  means  based  on  n  observations,  the  standard 
error  of  the  difference  in  two  means  (equation  3)  is  proportional  to  the  standard  error 
of  the  mean  (equation  1). 

^  -  =  Jvar(X^-X^=  ^2*var(X)=  (3) 

yjn 

where  Xbarj  =  average  of  n  observations  of  a  system  performance  measure  for 
system  1 

XbaTj  =  average  of  n  observations  of  a  system  performance  measure  for 
^stem  2 

The  following  acronyms  are  used  to  refer  to  runs  from  each  runtime  group:  2 
million  minutes— 2MMR,  S  million  minutes— SMMR,  10  million  minutes— lOMMR,  20 
million  minutes— 20MMR,  and  30  million  minutes—  30MMR. 
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4.1.2  Downtime  Results.  Means  and  variances  of  observed  downtimes  are 


used  to  produce  the  one  sigma  plots  of  the  standard  error  around  the  means  (CIM)  in 
Figures  4.1  dirough  4.S.  The  2MMR  and  SMMR  plots  (Figures  4.1  and  4.2)  reflect 
large  fluctuations  in  both  means  and  variances  for  averages  of  less  dian  7  runs.  These 


Figure  4.1:  Downtime  CIM—2  Million 
Minute  Runtime  Group 


Figure  4.2:  Downtime  CIM— S  Million 
Minute  Runtime  Group 


Numb«r  of  Rum  Avorogod 


Figure  4J:  Downtime  CEM-IO  Million  Figure  4.4:  Downtime  CIM-20  Million 
Minute  Runtime  Groiq)  Minute  Runtime  Group 

fluctuations  are  attributable  to  runtime  in  that  the  likelihood  of  observing  either  no 

failures  or  very  few  failures  is  greater  for  relatively  short  runtimes  (ie.  it  is  possible  to 

obtain  bad  point  estimates).  Comparison  of  die  lOMMR  and  20MMR  group  plots 
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reveals  stmilwities  bodi  in  means  and 


varittices,  indicating  little  added  gain 
from  doubling  die  runtime.  The 
30MMR  plot  shows  die  effect  of 
extending  runtime  to  this  extreme  (S7 
years  of  simulated  time)  is  a 
significant  reduction  in  variation  even 
for  small  numbers  of  runs. 

Results  from  plots  in  Figures  4.1  through  4.S  should  also  be  compared  to  die 
average  downtime  (per  1  million  minutes)  calculated  widi  die  analytical  spreadsheet 
model— 7.422  minutes.  The  10-run  averages  for  all  runtime  groups  were  higher  dian 
7.422  and  ranged  from  12.07  (2MMR)  to  28.76  (20MMR).  This  likely  indicates  a  bias 
in  the  simulation  model.  To  put  diis  bias  in  perspective  of  model  availability,  a 
difference  in  mean  downtime  of  25  minutes  represents  a  difference  in  model 
availability  of  .000025.  Since  system  downtime  can  only  be  estimated  with  confidence 
to  4  or  5  decimal  place  accuracy  anyway,  diis  difference  is  negligible.  Therefore, 
results  were  considered  accurate  enough  to  provide  a  basis  for  this  runtime  analysis. 

Figures  4.6  through  4.8  displ^  plots  of  die  95  percent  confidence  intervals  (Cl) 
for  mean  ^stem  downtime  for  averages  of  10  to  30  nms  calculated  as  explained  in 
section  4.1.1.  X-axes  reflect  die  number  of  runs  averaged,  Y-axes  reflect  the  mean 
downtime  per  million  minutes.  Plots  for  die  5MMR  and  20MMR  groups  are  included 
in  Appendix  F.4. 
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Flgtiie  4,5:  Downtime  CIM--30  Million 
Minute  Runtime  Group 
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Confidence  intervals  displayed  in  Figures  4.6  dirough  4.8  generally  support  an 
inverse  relationship  between  runtime  and  standard  error.  Standard  error  for  10-run 
averages  decreases  from  approximately  7  minutes  for  the  2MMR  group  to  1.7  minutes 
for  the  30MMR  group.  In  terms  of  model  availability,  this  represents  a  difference  of 
.0000053.  If  model  availability  is  accurate  only  to  five  decimal  places,  a  difference  of 
.0000053  is  negligible. 

Plots  of  the  standard  error  of 
differences  (SED)  depict  the  standard 
error  of  die  difference  between  two 
samples  obtained  from  runs  made  with 
different  ^stem  configinations.  SED 
plots  reflect  decreases  in  the  width  of 
the  la  confidence  intervals  directly 
proportional  to  those  illustrated  in 
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Figure  4,8:  Downtime  Cl— 30MMR 


Figures  4.6  through  4.8.  As  an 
example.  Figure  4.9  is  the  SED 
plot  for  the  SMMR  group.  This 
plot  indicates  that  if  the 
difference  between  IS-run 
downtime  averages  resulting  from 
two  different  system 
configurations  is  less  dian  IS,  we 
cannot  rqect  the  hypothesis  diat 
diese  samples  came  from  the  same  population.  In  odier  words,  we  cannot  reject  die 
hypodiesis  diat  die  two  system  configurations  produce  die  same  performance  results. 
This  type  of  analysis  could  be  particularly  useful  in  early  stages  of  system 
development. 

4.1.3  Critical  Failure  Results.  Analysis  of  die  mean  number  of  critical  failures 
produced  plots  almost  completely  identical  (except  for  units)  to  the  downtime  results. 
Similarly  to  downtime  results,  the  average  number  of  critical  failures  fell  consistendy 
higher  dian  die  .0808  per  million  minutes  average  calculated  widi  die  analytical  model. 
Averages  ranged  from  .25  (2MMR)  to  .49  (lOMMR).  In  terms  of  model  availability, 

.5  failures  per  million  minutes  represents  a  .00005  decrease  in  model  availability. 
Similarly  to  the  simulation  bias  noted  in  downtime  estimates,  this  bias  likely  does  not 
significandy  impact  results.  All  three  types  of  analysis  plots  constructed  widi  the 
critical  failure  data  are  included  in  Appendices  F.6  through  F.8. 


Figure  4,9:  Downtime  SED— 5MMR 
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4.1.4  Summary  of  Results.  A  recommendation  for  the  appropriate  number  of 
replications  is  based  primarily  on  results  displayed  in  the  CIM  plots.  Consistently 
across  runtime  groups  these  plots  suggest  that  an  average  of  at  least  6  or  7  runs  is 
needed  to  reach  fairly  stable  means  and  standard  errors.  Completion  of  additional  runs 
beyond  6  or  7  should  be  based  on  desired  accuracy  of  results.  The  smaller  die 
allowable  level  of  error,  the  greater  the  number  of  runs  that  must  be  simulated. 

A  recommendation  for  die  ^propriate  runtime  is  not  as  clear.  In  general,  plots 
indicate  a  reduction  in  variance  with  increases  in  runtime,  independent  of  number  of 
runs.  To  illustrate  die  selection  of  an  appropriate  runtime,  suppose  an  estimate  of 
system  downtime  (per  million  minutes  of  uptime)  is  required  to  be  within  10  minutes 
of  die  actual  downtime  with  9S  percent  confidence.  Referring  to  die  Cl  plots,  this 
translates  to  a  requirement  of  running  19  runs  for  2  million  minutes,  IS  runs  for  S 
million  minutes,  13  runs  for  10  million  minutes,  or  less  than  10  runs  for  die  20MMR 
and  30MMR  runtime  groups.  Given  this  example,  die  recommendation  would  be  to 
run  either  the  SMMR  or  lOMMR  combinations  in  an  effort  to  minimize  die  level  of 
simulation  effort.  Recommendations  resulting  from  diis  analysis  coincide  closely  with 
a  conclusion  reached  by  Whitt  in  his  article  on  "The  Efficiency  of  One  Long  Run 
Versus  Independent  Replications  in  a  Steady-State  Simulation"  (23:663).  He 
concludes  that  for  systems  that  reach  a  steady  state  quickly,  "...many  independent 
replications  can  be  much  more  efficient  dian  one  long  run.."  (23:663).  In  general,  it 
iqipears  diat  sufficient  accuracy  can  be  obtained  from  the  average  of  6  or  more 
replications  with  runtimes  20  times  longer  than  the  longest  MTBF.  Additional 
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accuracy  can  be  obtained  most  efficiently  by  increasing  die  number  of  r^lications 
whidi  in  turn  decreases  variability. 


4.2  Response  Surface  Analyses 

Re^nse  surface  analysis  allows  for  exploration  of  die  relationship  between  a 
system  performance  measure  (response)  and  any  number  of  controllable  system  input 
parameters  (factors).  These  types  of  relationships  can  be  characterized  by  a  regression 
equation  resulting  from  analysis  of  data  obtained  from  a  pacific  set  of  experimental 
runs.  Entire  courses  are  devoted  to  understmding  selection  of  an  appropriate  set  of 
experimental  runs  (experimental  designs)  and  therefore  will  not  be  discussed  in  detail 
here.  The  interested  reader  can  refer  to  Box  and  Draper’s  text.  Empirical  Model 
Building  and  Response  Surfaces,  for  a  thorough  discussion  of  diis  process  (20). 

Generally,  response  surface  mediods  (RSM)  of  analysis  require; 

1)  Selection  of  an  experimental  design. 

2)  Selection  of  factors  and  dieir  levels. 

3)  Completion  of  the  simulation  runs  and  collection  of  observed  results. 

4)  Calculation  of  regression  coefficients  and  corre^nding  significance  levels. 

5)  Diagnostic  testing  of  the  regression  model  suggested  by  step  3  to  determine 

adequacy  of  fit. 

6)  Selection  of  a  parsimonious  regression  model. 

Two  response  surface  analyses  were  selected  as  appropriate  in  analysis  of  the 
Granite  Sentry  system;  analysis  of  system  critical  downtime  as  a  function  of 
component  MTBFs  and  as  a  function  of  part  redundancies.  Regression  equations 
resulting  from  diese  analyses  could  be  used  to  predict  average  system  critical 
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downtime  based  on  any  combination  of  component  MTBFs  or  of  part  redundancies 
included  in  die  design  regions. 

4.2.1  System  Downtime  AruJysis— Component  MTBFs.  Prior  to  selection  of 
an  experimental  design,  the  effect  of  variation  in  component  MTBFs  on  system 
downtime  was  coarsely  studied  through  calculation  of  upper  and  lower  bounds  on 
^stem  downtime.  These  bounds  were  calculated,  using  the  analytical  model,  by 
setting  all  component  MTBFs  at  dieir  re^ective  upper  and  lower  95  percent 
confidence  interval  limits.  Lower  and  upper  average  annual  downtime  bounds  were 
calculated  as,  respectively,  1.6  minutes  and  10  minutes.  A  difference  in  bounds  of 
only  8.4  minutes  of  system  downtime  per  year  suggested  response  surface  development 
was  unnecessary.  The  variance  of  die  computer  output  alone,  due  to  the  randomness 
of  the  ou^ut,  would  likely  mask  differences  of  this  magnitude  and  result  in  calculation 
of  a  constant  model.  This  small  difference  in  bounds  also  indicated  the  possibility  of 
excess  redundancy  in  system  components. 

4.2.2  System  Downtime  Analysis— Part  Redundmcies. 

The  above  analysis,  as  well  as  basic  knowledge  of  extensive  part  redundancies, 
suggested  analysis  of  the  relationship  between  part  redundancies  and  average  system 
downtime.  Upper  and  lower  bounds  on  system  downtime  were  calculated  to  determine 
the  range  of  results  possible.  The  upper  bound,  14,927.04  minutes  aimually,  represents 
average  aimual  system  downtime  for  a  system  witfi  no  part  redundancies.  The  lower 
bound,  3.68  minutes  annually,  represents  a  system  with  complete  designed  part 
redundancies.  This  wide  range  suggested  the  feasibility  of  a  response  surface  analysis 
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^ce  it  ^qiears  A«t  some  part  redundancies  have  a  significant  effect  on  average 
annual  system  downtime. 

A  two-level  saturated  factorial  design  of  Resolution  III  was  chosen  for  the 
analysis  since  no  interactions  between  components  were  expected  in  this  system 
(20:148-154).  Part  redundancies  for  all  13  critical  system  components  were  chosra  as 
factors.  Factor  Imrels  were  set  as  representative  of  no  redundancy  (low)  and  complete 
designed  redundancy  (high)  and  are  listed  in  Table  4.1.  Specific  experimoital  design 
and  downtimes  resulting  from  die  16  simulation  runs  are  listed  in  Appendix  G.l. 


ComponeBt  Name 

Low  Level 
Uncoded 

(Number  of  parts) 

High  Level 
Uncoded 

(Number  of  parts) 

Gatewi^ 

1 

2 

Mission  Gateway  Software 

1 

2 

Air  Gatewiy  Software 

1 

2 

Mission  Processor 

1 

5 

Air  Mis»on  Software 

1 

2 

Command  Post  Software 

1 

2 

Status  Monitor  Software 

1 

5 

1  Power  Distribution  Unit 

1 

2 

1  HSC  70  Controller 

1 

2 

Star  Coiqiler 

1 

2 

RA82  Disk  Drive-shadow  sets 

8 

10 

ADOC  workstations 

3 

6 

NCC  workstations 

7 

STATGRAPHICS  was  used  to  perform  an  ANOVA  and  a  least  squares 


regression  analysis  of  the  system  downtimes  resulting  from  the  experimental  runs.  The 
ANOVA  table  summariadng  the  effect  of  including  all  factors  in  the  model  is  displayed 
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in  Table  4.2.  This  initial  analysis  revealed  diree  significant  factors,  number  of  Mission 
Gatewi^  Software  parts,  number  of  AIX)C  workstations,  and  number  of  NCC 
workstations.  The  odier  factors  had  significance  levels  ranging  from  201 S  to  9229 
and  were  deleted  from  die  model  as  statistically  insignificant  to  avoid  over¬ 
specification  of  die  model  . 


ANOVA  for  Average  Annual  Downtime  -  13  factor  study 


Effect 

Sum  of  Squares 

DF 

Mean  Sq. 

F-Ratio 

P-value 

A:GW 

18747 

1 

1.8747E0004 

.03 

.8770 

BAGW 

29540 

1 

2.9540E0004 

.05 

.8464 

CdMGW 

10641535 

1 

1.0642E0007 

17,91 

.0515 

D:MP 

7295 

1 

7.2948E0003 

.01 

.9229 

E:AM 

2089942 

1 

2.0899E0006 

3.52 

.2015 

F:CP 

264234 

1 

2.6423E0005 

.44 

.5798 

G:SM 

1837440 

1 

1.8374E0006 

3.09 

.2207 

H:PDU 

783885 

1 

7.8389E0005 

1.32 

.3695 

I:HSC 

690954 

1 

6.9095E0005 

1.16 

.3936 

J:SC 

866459 

1 

8.6646E0005 

1.46 

.3506 

K.RA82 

1014148 

1 

1.0141E0006 

1.71 

.3214 

LiADOC 

39410348 

1 

3.9410E0007 

66J5 

.0147 

Md4CC 

304784103 

1 

3.0478E0008 

513.09 

.0019 

Total  error 

1188030 

2 

5.9402E0005 

Total  (corr.)  363626662  15 


R-squared  =  0.996733  R-squared  (adj.  for  d.f.)  =  0.975496 


Table  4J:  Full  ANOVA  Table 

The  ANOVA  for  the  reduced  model,  containing  only  significant  factors,  is 
displayed  in  Table  4.3.  Note  the  R-squared  value  here  of  .975  indicates  we  have  a 
good  fit  to  die  data.  Odier  indications  of  an  acceptable  model  are  displayed  in  die 
standard  diagnostic  plot  of  the  residuals  and  in  die  plot  of  observed  versus  predicted 
values  included  in  Appendix  G.2.  Except  for  two  possible  oudiers,  die  residuals 
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displi^  homoscedasdcity.  The  plot  of  observed  versus  predicted  values  shows  a  clear 
linear  troid.  Thus,  die  model  selected  closely  approximates  die  true  response  surface 
representing  system  downtime  as  a  function  of  part  redundancies. 

It  is  surprising  diat  such  a  good  fit  was  found  with  a  linear  model  vs^oi 
diminishing  decreases  in  downtime  from  additional  parts  would  be  expected.  Since 
the  levels  for  eight  of  die  components  represent  one  part  versus  two,  the  middle  of  the 
design  region  really  has  no  interpretation.  Therefore,  since  only  die  extreme  points 
have  meaning,  the  regression  equation  really  does  reflect  a  linear  relationship  for  these 
components.  Possibly  v^at  is  happening  is  that  the  effect  of  diese  eight  components 
is  masking  the  dimini^ing  returns  from  die  odier  five  components.  Additionally, 
because  of  consistentiy  high  estimates  of  model  availability,  die  region  modelled  is 
likely  representative  of  die  high  end  of  die  downtime  returns  curve.  If  this  is  die 
case,  diis  relatively  small  region  of  die  curve  could  be  reasonably  estimated  by  a  linear 
model. 


ANOVA  for  Average  Annual  Downtime  -  13  factor  study 


Effect 

Sum  of  Squares 

DF 

Mean  Sq. 

F-Ratio 

P-value 

C;MGW 

10,641,535 

1 

1.0642E0007 

14.53 

.0025 

L:ADOC 

39,410,348 

1 

3.9410E0007 

53.80 

.0000 

M:NCC 

304,784,103 

1 

3.0478E0008 

416.06 

.0000 

Total  error 

8,790,675 

12 

7.3256E0005 

Total  (cotr.) 

363,626,662 

15 

R-squared  = 

0.975825 

R-squared  (adj.  for  d.f.)  = 

0.969781 

TidUe  4J;  Reduced  ANOVA  Table-Significant  Factors 
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The  suggested  regression  model  in  the  uncoded  region,  with  coefficients  rounded  to 
whole  numbers  is; 

Annual  System  Downtime=  49376  -  1631  (MGW)  -  1046  (ADOC)  -  4365  (NCC) 

where  MGW  =  uncoded  number  of  Mission  Gateway  Software  parts 

ADOC  -  uncoded  number  of  ADOC  workstations 

NCC  =  uncoded  number  of  NCC  workstations 

Setting  all  of  die  signiiGcant  factors  to  their  high  levels  yields  a  downtime 
prediction  of  SS6  minutes.  This  is  die  only  prediction  that  can  be  compared  to 
previous  results,  since  previous  results  were  calculated  for  a  fiilly  redundant  system. 
This  average  seems  high  v4ien  compared  to  the  analytical  estimate  of  7.422  minutes; 
however,  the  model  standard  deviation,  approximately  8S6  minutes,  explains  this 
difference  and  emphasizes  the  fact  that  diis  is  truly  a  coarse  model  of  die  system.  In 
order  for  substantiated  conclusions  to  be  drawn  from  diis  type  of  regression  model,  an 
estimate  of  mean  square  error  (MSE)  on  the  order  of  the  variances  calculated  for  the 
10-run  averages  in  die  runtime  analysis  would  be  iqipropriate  (200-400  minutes). 
Obtaining  this  level  of  MSE  could  involve  reduction  of  the  design  region  and/or 
addition  of  experimental  runs. 

The  fact  diat  all  significant  component  coefficients  are  negative  means  that  the 
greater  the  part  redundancy  in  these  components,  die  smaller  the  prediction  of  annual 
system  downtime.  The  negative  coefficients  dierefore  suggest  that  maximum 
redundancy  in  diese  significant  components  produces  the  system  configuration  with  the 
highest  model  availability. 
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The  coefficimt  of  -4365  on  the  NCC  workstations  suggests  that  one  NCC 
workstation  is  worth  a  savings  of  436S  minutes  of  downtime  annually,  or  a  savings  of 
approximately  48  system  critical  failures.  Since  the  design  region  restricts  us  to  a 
maximum  of  9  NCC  workstations,  the  greatest  possible  reduction  in  annual  downtime 
is  39,281  minutes.  This  reduction  translates  to  a  change  in  model  availability  of  .075 
vdiich  is  definitely  significant.  The  NCC  coefficient  can  also  be  compared  widi  the 
AOOC  coefficient  of  -1046.  Since  the  NCC  coefficient  is  roughly  4  times  larger  dian 
the  ADOC  coefficient,  this  suggests  that  addition  of  one  workstation  in  the  NCC  is 
worth  roughly  4  times  as  much  as  addition  of  one  workstation  in  the  ADOC  in  terms 
of  critical  system  downtime.  Similarly,  in  terms  of  critical  system  downtime  one  NCC 
workstation  is  worth  tqiproximately  2.5  Mission  Gateway  software  parts.  These  types 
of  comparisons,  made  based  on  a  model  with  less  variance,  could  provide  valuable 
information  to  system  designers  determining  the  most  critical  areas  to  increase 
redundancy  in  the  system. 

The  redundancy  of  the  components  not  represented  in  the  regression  model 
does  not  have  a  significant  effect  on  average  annual  downtime  compared  to  the  error 
inherent  in  die  model.  The  command  post  (CP)  software  component  can  be  used  to 
illustrate  how  this  insignificance  translates  to  system  downtime.  The  CP  software  has 
two  parts,  each  with  an  estimated  availability  of  .999755.  On  the  average,  one 
command  post  software  element,  functioning  widiout  backup,  contributes  1 28  minutes 
to  total  system  downtime  annually.  When  two  command  post  software  elements 
function  together  in  the  system,  the  component  availability  is  ont  he  order  of 
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9999999,  translating  to  a  contribution  of  .05  minutes  of  system  downtime  annually  by 
the  entire  component.  The  regression  analysis  considered  the  increase  from  .05  to  128 
minutes  to  be  insignificant  because  the  level  of  uncertainty  in  the  model  riders 
relatively  small  changes  indistinguishable  from  random  variations.  A  mean  square 
error  (MSE)  of  732,560  can  potentially  mask  a  wide  range  of  factors  and  dierefore 
indicates  the  model  should  be  refined  before  use  in  real  time  system  analysis. 
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V,  Conclusions  and  Research  Recommendations 


5.1  Conclusions 

Construction  of  a  prototype  availability  simulation  model  of  Granite  Sentry 
fulfilled  the  primary  purpose  of  diis  research  as  outlined  by  AFOTEC.  Currently,  the 
model  provides  a  number  of  system  performance  measures  as  a  function  of  component 
MTBFs  and  MTTRs.  This  model  could  be  extended  to  incorporate  effects  of  odier 
factors  known  to  influence  the  system  such  as  maintenance  concepts,  supply  levels, 
and  software  failures  induced  by  message  receipt.  Given  these  types  of  extensions,  the 
simulation  could  become  more  representative  of  die  actual  system. 

Analysis  of  failure  data  prior  to  model  construction  supported  the  generally 
accepted  use  of  exponentially  distributed  failure  rates  and  lognormally  distributed 
repair  times.  While  other  distributions  like  die  weibull  or  lognormal  often  provided  a 
better  fit  to  the  TBF  data,  the  exponential  distribution  was  always  adequate.  Similarly, 
a  lognormal  distribution  always  provided  an  adequate  fit  to  die  TTR  data,  though  the 
weibull  distribution  was  often  selected  as  providing  the  best  fit. 

Use  of  a  Microsoft  Windows  version  of  SLAMSYSTEM  made  building  the 
initial  network  model  extremely  efficient.  Modelling  becomes  somewhat  object- 
oriented  with  the  pictorial  diagramming  available  in  this  software.  Less  time  is  wasted 
on  model  coding  details,  allowing  more  time  to  focus  on  model  intricacies,  which  is 
especially  useful  during  the  initial  phase  of  model  construction. 
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Results  of  the  runtime  analysis  suggested  at  least  6  runs  are  needed  to  reach  a 
stabilized  estimate  of  both  the  mean  and  variance  of  a  system  performance  measure. 
Additionally,  a  runtime  estimate  of  20  times  longer  dian  the  longest  MTBF  appeared 
to  produce  reasonably  efficient  and  accurate  results.  In  general,  bodi  runtime  and 
replications  ^ould  be  determined  by  die  accuracy  of  results  desired—die  greater  the 
accuracy,  die  greater  the  number  of  replications. 

This  research  strongly  supports  the  use  of  analytical  modelling  as  a 
fundamental  analysis  tool.  Specifically  during  this  research  the  analytical  model 
developed,  though  a  very  basic  system  representation,  proved  to  be  essential  for 
simulation  model  validation.  It  provided  sanity  checks  essential  to  development  of  a 
representative  simulation  model. 

5.2  A  reas  for  Further  Research 

Since  this  research  developed  a  specific  model  for  Granite  Sentry,  the  need  still 
exists  to  assist  AFOTEC  in  developing  a  generalized  method  for  availability 
simulation  modelling.  Developing  general  modelling  "subroutines"  used  to  represent  a 
wide  variety  of  system  components  and  their  failures  would  greatly  facilitate 
construction  of  these  availability  simulation  models.  The  code  developed  in  this  and 
Brown's  thesis  (S)  would  be  a  solid  starting  point  for  developing  this  kind  of 
generalized  or  object-oriented  modelling.  A  segmented  ^proach  as  outlined  in 
Chapter  3  would  be  a  structured  means  of  beginning  this  research.  The  scope  of  this 
task  could  be  limited  through  selection  of  specific  system  types  to  be  modelled. 
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If  time  had  permitted,  a  continuous-time  markov  chain  model  of  the  system 
would  also  have  bera  constructed  during  this  research.  This  type  of  analytical 
i4>proach  offers  extensive  system  information  through  state  transition  and  limiting 
probabilities.  This  type  of  model  would  require  the  assumption  that  repair  times  are 
exponentially  distributed  ^ch,  from  Granite  Sentry  TTR  data,  would  not  be  an 
unreasonable  assumption. 

With  a  model  as  complex  as  Granite  Sentry,  the  system  would  likely  first  be 
decomposed  and  balance  equations  solved  at  die  component  level.  Model 
development  would  begin  widi  determination  of  the  states  which,  at  die  component 
level,  could  represent  die  number  of  failed  parts  in  die  component.  Components  with 
two  parts  could  be  in  three  possible  states~0,  1,  or  2.  Once  balance  equations  were 
solved  to  determine  state  transition  probabilities  for  components,  this  information 
would  be  combined  at  the  system  level.  System  level  states  could  be  represented  by  a 
n-dimensional  vector  whose  entries  represent  the  state  of  each  of  n  components  in  the 
system.  Values  in  die  vector  could  be  0-1  variables  indicating  whether  the  critical 
number  of  component  parts  were  functioning.  Results  of  this  type  of  analysis  could 
provide  details  of  system  performance  at  both  die  component  and  system  level. 
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Appendix  A 

1992  Failure  Summary  Database 


IR/JCN 

Culprit 

Failure 
start  (min) 

DwnTime  Critical 

Relevant 

Failure 

End  (min) 

9102-060 

air  gw 

720 

25 

0 

1 

745 

9102-069 

air  gw 

32400 

0 

0 

1 

32400 

9102-074 

air  gw 

33840 

1 

0 

0 

33841 

9102-101 

air  gw 

52560 

0 

0 

1 

52560 

9102-108 

air  gw 

65520 

4 

0 

1 

65524 

9102-111 

air  gw 

68400 

4 

0 

1 

68404 

9102-124 

air  gw 

81360 

0 

0 

1 

81360 

2954003  air  gw 

425520 

72 

0  n/a 

425592 

9202-080 

air gw 

491760 

96 

0  n/a 

491856 

9202-019 

air  gw 

415440 

73 

0 

1 

415513 

ir-225 

am 

190800 

5 

1 

190805 

ir-232 

am 

199440 

1 

1 

199441 

ir-248 

am 

209520 

62 

1 

209582 

9202-035 

am 

425520 

0 

0 

1 

425520 

9202-040 

am 

434160 

12 

1 

1 

434172 

9102-112 

am 

69840 

1 

0 

1 

69841 

9102-153 

am 

102960 

216 

1 

1 

103176 

9102-196 

am 

150480 

0 

0 

1 

150480 

9202-098 

am 

526320 

0 

0 

1 

526320 

ir-238 

cp 

200880 

60 

0 

1 

200940 

ir-074 

cp 

270000 

110 

0 

1 

270110 

9201-116 

cp 

372240 

0 

0  n/a 

372240 

9202-021 

cp 

418320 

17 

1 

1 

418337 

9202-047 

cp 

441360 

2 

0 

1 

441362 

9202-049 

cp 

445680 

1 

1 

1 

445681 

9202-058 

cp 

455760 

36 

1 

1 

455796 

9202-068 

cp 

470160 

2 

1 

1 

470162 

9102-061 

cp 

6480 

0 

0 

1 

6480 

9102-065 

cp 

29520 

0 

0 

1 

29520 

9202-002 

gw 

385200 

6 

1  n/a 

385206 

9202-025 

gw 

422640 

2 

0  n/a 

422642 

3284008  gw 

471600 

85 

1  n/a 

471685 

9202-070 

gw 

473040 

214 

1  n/a 

473254 

58 


9102-128 

gw 

82800 

0 

0 

1 

82800 

ir-0B4 

mp 

245520 

225 

0 

1 

245745 

ir-060 

mp 

245520 

395 

1 

245915 

9202-044 

mp 

439920 

31 

1 

1 

439951 

304012  mp 

42480 

50 

0 

1 

42530 

304028  mp 

42480 

130 

0 

1 

42610 

9102-202 

mp 

159120 

162 

0 

1 

159282 

924006  mp 

131760 

30 

0 

1 

131790 

9102-114 

mp 

72720 

350 

0 

1 

73070 

3004001 

mp 

431280 

106 

0 

1 

431386 

9202-078 

mp 

488880 

0 

0 

0 

488880 

9102-073 

mw  gw 

33840 

4 

0 

1 

33844 

9102-123 

mwgw 

81360 

15 

0 

1 

81375 

9102-156 

mwgw 

102960 

23 

0 

1 

102983 

9102-158 

mwgw 

105840 

4 

0 

1 

105844 

9102-164 

mwgw 

110160 

11 

1 

1 

110171 

9102-179 

mwgw 

134640 

1 

0  n/a 

134641 

ir-242 

mwgw 

205200 

30 

0 

205230 

ir-247 

mwgw 

209520 

2 

1 

209522 

9201-088 

mwgw 

307440 

81 

0  n/a 

307521 

9201-089 

mwgw 

316080 

92 

0  n/a 

316172 

9202-024 

mwgw 

422640 

26 

0  n/a 

422666 

9202-038 

mwgw 

432720 

1 

1  n/a 

432721 

9202-051 

mw  gw 

445680 

0 

0  n/a 

445680 

9202-054 

mw  gw 

447120 

11 

1  n/a 

447131 

9202-056 

mwgw 

451440 

2 

1  n/a 

451442 

9202-062 

mwgw 

465840 

3 

1  n/a 

465843 

9202-065 

mwgw 

467280 

96 

1  n/a 

467376 

326401 2  mw  gw 

468720 

318 

1  n/a 

469038 

9202-081 

mwgw 

491760 

0 

0  n/a 

491760 

9102-076 

mw  gw 

41040 

4 

0 

1 

41044 

9102-089 

mw  gw 

46800 

1 

0 

1 

46801 

9202-023 

mw  gw 

418320 

38 

0  n/a 

418358 

294401 0  mw  gw 

424080 

215 

0  n/a 

424295 

9202-029 

mw  gw 

425520 

10 

0  n/a 

425530 

9202-077 

mwgw 

486000 

19 

0  n/a 

486C19 

9202-077 

mwgw 

487440 

31 

0  n/a 

487471 

9102-191 

ra82 

144720 

105 

0 

1 

144825 

1434013  ra82 

205200 

169 

1 

205369 

59 


ir-009 

ra82 

216720 

255 

0 

1 

216975 

ir-015 

ra82 

219600 

175 

0 

1 

219775 

ir-020 

ra82 

221040 

191 

0 

1 

221231 

ir-026 

ra82 

223920 

50 

0 

0 

223970 

ir<055 

ra82 

245520 

165 

0 

1 

245685 

1774006  ra82 

254160 

110 

1 

254270 

9201-090 

ra82 

323280 

645 

0 

1 

323925 

9201-100 

ra82 

337680 

65 

1 

1 

337745 

9201-101 

ra82 

342000 

185 

0 

1 

342185 

9202-032 

ra82 

426960 

443 

0 

1 

427403 

3134005  ra82 

450000 

23 

0 

1 

450023 

9202-082 

ra82 

494640 

285 

0 

1 

494925 

9202-084 

ra82 

494640 

455 

0 

1 

495095 

9202-083 

ra82 

494640 

60 

0 

1 

494700 

9202-085 

ra82 

496080 

76 

0 

1 

496156 

9202-096 

ra82 

524880 

802 

0 

1 

525682 

9102-176 

sm 

127440 

4320 

0 

0 

131760 

9102-187 

sm 

140400 

45 

0 

1 

140445 

ir-234 

sm 

200880 

150 

1 

201030 

ir-239 

sm 

202320 

77 

1 

202397 

ir-255 

sm 

212400 

46 

1 

212446 

ir-004 

sm 

215280 

1 

0 

1 

215281 

ir-007 

sm 

216720 

75 

0 

1 

216795 

ir-037 

sm 

232560 

20 

0 

1 

232580 

ir-059 

sm 

245520 

15 

0 

1 

245535 

9202-005 

sm 

390960 

1 

0 

1 

390961 

9202-016 

sm 

406800 

25 

0 

1 

406825 

9202-060 

sm 

458640 

16 

0  n/a 

458656 

9202-061 

sm 

461520 

2 

0 

1 

461522 

9202-063 

sm 

465840 

0 

0 

1 

465840 

9202-071 

sm 

473040 

124 

1  n/a 

473164 

9102-062 

sm 

7920 

81 

0 

1 

8001 

9102-193 

sm 

147600 

25 

0 

1 

147625 

1 526009  ws  hw 

219600 

40 

0 

0 

219640 

1004006  ws  hw 

143280 

12 

0 

1 

143292 

1 574004  ws  hw 

225360 

15 

0 

1 

225375 

9102-203 

ws  hw  1 

160560 

137 

0 

1 

160697 

9102-199 

ws  hw  10 

156240 

57 

0 

1 

156297 

300401 1  ws  hw  10 

431280 

13 

0 

1 

431293 

60 


9102-106  wshwlO 

64080 

135 

0 

1 

64215 

684002  ws  hw  1 1 

97200 

60 

0 

1 

97260 

1576007  wshw  11 

225360 

45 

0 

0 

225405 

5401 2  WS  hw  1 1 

6480 

40 

0 

1 

6520 

2454012  wshw  12 

352080 

75 

0 

1 

352155 

9102-161  wshw  13 

108720 

94 

0 

1 

108814 

3074004  ws  hw  14 

441360 

140 

0 

1 

441500 

1174003  wshw  15 

167760 

20 

0 

1 

167780 

3394004  wshw  IS 

487440 

90 

0 

1 

487530 

9102-135  wshw  18 

88560 

70 

0 

1 

88630 

9102-119  wshw  19 

79920 

75 

0 

1 

79995 

9102-155  wshw  19 

102960 

70 

0 

1 

103030 

864008  ws  hw  2 

123120 

15 

0 

1 

123135 

9102-184  wshw 2 

138960 

154 

0 

1 

139114 

1294004  ws  hw2 

185040 

40 

0 

1 

185080 

564011  wshw  23 

79920 

20 

0 

1 

79940 

3364001  ws  hw  24 

481680 

30 

0 

1 

481710 

1794007  wshw 25 

258480 

43 

0 

1 

258523 

3594002  ws  hw  25 

517680 

101 

0 

1 

517781 

294008  ws  hw  25 

41040 

128 

0 

1 

41168 

3354007  wshw 26 

473040 

0 

0 

1 

473040 

3364007  ws  hw  26 

481680 

10 

0 

1 

481690 

866002  ws  hw  27 

123120 

5 

0  n/a 

123125 

9102-174  wshw 28 

126000 

74 

0 

1 

126074 

9201-102  wshw 28 

342000 

60 

0 

1 

342060 

9202-034  wshw 28 

429840 

20 

0 

1 

429860 

64006  ws  hw  29 

7920 

75 

0 

1 

7995 

324012  wshw 29 

45360 

110 

0 

1 

45470 

2394010  wshw  3 

343440 

15 

0 

1 

343455 

3044007  ws  hw  3 

438480 

59 

0 

1 

438539 

9201-114  wshw 32 

366480 

1805 

0 

1 

368285 

9202-092  wshw 32 

522000 

39 

0 

1 

522039 

3630003  ws  hw  32 

523440 

84 

0 

1 

523524 

9202-093  wshw 33 

522000 

89 

0 

1 

522089 

636006  ws  hw  4 

90000 

151  n/a 

1 

90151 

9102-183  wshw 4 

138960 

91 

0 

1 

139051 

9102-190  wshw 4 

143280 

45 

0 

1 

143325 

1 744005  WS  hw  4 

245520 

35 

0 

1 

245555 

2764006  ws  hw  4 

396720 

79 

0 

1 

396799 

61 


9202-089 

wshw  4 

514800 

34 

0 

1 

514834 

3604005  ws  hw  4 

517680 

55 

0 

1 

517735 

9102-086 

ws  hw  4 

43920 

35 

0 

1 

43955 

434004  ws  hw  4 

61200 

35 

0 

1 

61235 

314004  wshw  S 

43920 

23 

0 

1 

43943 

9102-085 

wshw  5 

43920 

74 

0 

1 

43994 

9102-090 

wshwS 

46800 

350 

0 

1 

47150 

9102-186 

wshw  6 

138960 

197 

0 

1 

139157 

1526005  wshw 6 

218160 

40 

0 

0 

218200 

2074006  ws  hw  6 

297360 

10 

0 

0 

297370 

1134019  wshw 8 

162000 

12 

0  n/a 

162012 

1526006  wshw 8 

218160 

45 

0 

0 

218205 

224016  wshw 8 

30960 

42 

0 

1 

31002 

9102-066 

wshw  8 

30960 

152 

0 

1 

31112 

714006  wshw 9 

101520 

30 

0 

1 

101550 

ir-21 1 

wshw  9 

179280 

233 

0 

1 

179513 

ir-21 1 

wshw  9 

179280 

233 

0 

1 

179513 

9102-100 

ws  sw 

51120 

23 

0 

1 

51143 

9102-105 

ws  sw 

64080 

15 

0 

1 

64095 

9102-121 

wssw  1 

79920 

50 

0 

1 

79970 

9102-149 

wssw  1 

100080 

15 

0 

1 

100095 

ir-21 0 

ws  sw  1 

174960 

12 

0 

1 

174972 

ir-002 

ws  sw  1 

215280 

241 

0 

1 

215521 

ir-022 

ws  sw  1 

223920 

10 

0 

1 

223930 

ir-028 

ws  sw  1 

226800 

12 

0 

1 

226812 

ir-046 

ws  sw  1 

236880 

12 

0 

1 

236892 

ir-051 

ws  sw  1 

241200 

231 

0 

1 

241431 

374013 

ws  sw  1 

52560 

10 

0 

1 

52570 

49401 1 

ws  sw  1 

69840 

33 

0 

1 

69873 

9102-147 

ws  sw  10 

97200 

32 

0 

1 

97232 

9102-177 

wssw  10 

130320 

40 

0 

1 

130360 

ir-21 8 

ws  sw  10 

189360 

25 

0 

1 

189385 

1684003  ws  sw  10 

241200 

20 

0 

1 

241220 

54001  ws  sw  10 

6480 

45 

0 

1 

6525 

9102-094 

ws  sw  10 

48240 

13 

0 

48253 

9102-162 

ws  sw  1 1 

110160 

51 

0 

1 

110211 

ir-036 

ws  sw  1 1 

231120 

49 

0 

1 

231169 

64013  ws  sw  11 

7920 

0 

1 

7920 

9102-163 

wssw  12 

110160 

165 

0 

1 

110325 

62 


ir-14 

ws  sw  12 

219600 

45 

0 

1 

219645 

9102-080 

ws  sw  12 

41040 

25 

0 

1 

41065 

9102-109 

wssw  12 

66960 

60 

0 

1 

67020 

9102-115 

ws  sw  12 

75600 

15 

0 

1 

75615 

9102-120 

ws  sw  13 

79920 

728 

0 

1 

80648 

1134012 

ws  sw  13 

162000 

25 

0 

1 

162025 

ir-215 

ws  sw  13 

182160 

26 

0 

0 

182186 

ir-027 

ws  sw  13 

226800 

15 

0 

1 

226815 

9102-071 

ws  sw  13 

32400 

20 

0 

1 

32420 

9102-072 

ws  sw  14 

32400 

20 

0 

1 

32420 

ir-216 

ws  sw  14 

182160 

40 

0 

0 

182200 

ir-050 

ws  sw  15 

241200 

12 

0 

1 

241212 

1684003 

ws  sw  15 

241200 

20 

0 

1 

241220 

274001 

ws  sw  15 

38160 

37 

0 

1 

38197 

9102-130 

ws  sw  16 

84240 

53 

0 

1 

84293 

9102-198 

ws  sw  16 

151920 

73 

0 

1 

151993 

9102-126 

ws  sw  17 

81360 

275 

0 

1 

81635 

9102-171 

ws  sw  17 

123120 

30 

0 

1 

123150 

ir-209 

ws  sw  17 

174960 

33 

0 

1 

174993 

104002 

ws  sw  17 

13680 

12 

0 

1 

13692 

9102-087 

ws  sw  17 

45360 

72 

0 

1 

45432 

9102-131 

ws  sw  18 

85680 

41 

0 

1 

85721 

ir-053 

wssw  18 

245520 

25 

0 

1 

245545 

ir-042 

ws  sw  19 

234000 

20 

0 

1 

234020 

9102-194 

wssw  2 

147600 

298 

0 

1 

147898 

ir-204 

ws  sw  2 

169200 

50 

0 

1 

169250 

ir-206 

ws  sw2 

172080 

12 

0 

1 

172092 

ir-214 

ws  sw  2 

180720 

30 

0 

1 

180750 

lr-023 

wssw  2 

223920 

25 

0 

1 

223945 

1636006 

ws  sw  2 

234000 

30 

0 

1 

234030 

ir-047 

ws  sw2 

236880 

12 

0 

1 

236892 

ir-048 

ws  sw  2 

239760 

12 

0 

1 

239772 

9102-093 

ws  sw2 

48240 

12 

0 

1 

48252 

9102-144 

ws  sw22 

94320 

177 

0 

1 

94497 

9102-122 

ws  sw23 

79920 

210 

0 

1 

80130 

9102-195 

ws  sw  23 

149040 

115 

0 

1 

149155 

ir-207 

ws  sw  24 

172080 

32 

0 

1 

172112 

ir-213 

ws  sw  24 

180720 

45 

0 

1 

180765 

ir-221 

wssw  24 

190800 

20 

1 

190820 

63 


ir-222 

ws  sw  24 

190800 

65 

1  190865 

ir- 

>24 

ws  sw  24 

223920 

22 

0 

1  223942 

ir- 

>32 

ws  sw  24 

228240 

10 

0 

1  228250 

ir- 

>41 

ws  sw  24 

234000 

18 

0 

1  234018 

91 

02-078 

ws  sw  24 

41040 

25 

0 

1  41065 

9 

02-132 

ws  sw  25 

85680 

50 

0 

1  85730 

9 

02-137 

ws  sw  25 

88560 

23 

0 

1  88583 

9102-150 

ws  sw25 

101520 

50 

0 

1  101570 

9n  02-1 59 

wssw25 

107280 

36 

0 

1  107316 

9102-189 

wssw25 

141840 

60 

0 

1  141900 

9102-200 

ws  sw25 

156240 

40 

0 

1  156280 

i-018 

ws  sw  25 

221040 

12 

0 

1  221052 

/r-025 

wssw25 

223920 

15 

0 

1  223935 

/lr-040 

ws  sw25 

232560 

6 

0 

1  232566 

fir-043 

ws  sw25 

234000 

39 

0 

1  234039 

ir-045 

wssw25 

236880 

35 

0 

1  236915 

9102-077 

wssw25 

41040 

147 

0 

1  41187 

9102-096 

WSSW25 

49680 

2 

0 

1  49682 

9102-099 

wssw25 

51120 

29 

0 

1  51149 

9102-103 

ws  sw  25 

55440 

0 

0 

1  55440 

9102-166 

ws  sw  26 

111600 

30 

0 

1  111630 

9102-092 

ws  sw  26 

48240 

90 

0 

1  48330 

9102-107 

ws  sw26 

65520 

17 

0 

1  65537 

9102-175 

ws  sw  27 

128880 

60 

0 

1  128940 

284010 

ws  sw  27 

39600 

35 

0 

1  39635 

9102-117 

ws  sw  28 

75600 

15 

0 

1  75615 

9102-125 

ws  sw  28 

81360 

20 

0 

1  81380 

9102-133 

ws  sw  28 

87120 

40 

0 

1  87160 

9102-197 

ws  sw28 

151920 

23 

0 

1  151943 

ir-205 

ws  sw  28 

170640 

15 

0 

1  170655 

ir-208 

ws  sw  28 

173520 

37 

0 

1  173557 

ir-011 

ws  sw  28 

216720 

11 

0 

1  216731 

ir-030 

ws  sw  28 

226800 

288 

0 

1  227088 

ir-038 

wssw28 

232560 

0 

0 

1  232560 

9102-095 

wssw28 

48240 

0 

0 

1  48240 

874015 

ws  sw  29 

124560 

16 

0 

1  124576 

ir-217 

ws  sw3 

183600 

106 

0 

1  183706 

1614009 

ws  sw  3 

231120 

20 

0 

1  231140 

9102-138 

ws  sw4 

90000 

20 

0 

1  90020 

64 


9102-139 

ws  sw  4 

90000 

20 

0 

1  90020 

9102-140 

ws  sw  4 

91440 

35 

1 

1  91475 

9102-145 

ws  sw  4 

94320 

67 

0 

1  94387 

9102-146 

ws  sw  4 

94320 

90 

0 

1  94410 

9102-148 

ws  sw  4 

97200 

25 

0 

1  97225 

9102-167 

ws  sw  4 

113040 

35 

0 

1  113075 

9102-181 

ws  sw  4 

134640 

101 

0 

1  134741 

9102-182 

ws  sw  4 

136080 

13 

0 

1  136093 

9102-192 

ws  sw4 

146160 

47 

0 

1  146207 

ir-13 

ws  sw4 

218160 

223 

0 

1  218383 

ir-031 

ws  sw4 

228240 

22 

0 

1  228262 

1614010 

ws  sw  4 

231120 

20 

0 

1  231140 

9102-079 

ws  sw  4 

41040 

25 

0 

1  41065 

9102-102 

ws  sw4 

52560 

136 

0 

1  52696 

9102-136 

ws  sw  5 

88560 

44 

0 

1  88604 

9102-157 

ws  sw  S 

102960 

10 

0 

1  102970 

9102-160 

ws  sw  5 

108720 

20 

0 

1  108740 

lr-219 

ws  sw  5 

187920 

496 

1  188416 

ir-223 

ws  sw  5 

190800 

162 

1  190962 

ir-008 

ws  sw  5 

216720 

18 

0 

1  216738 

9102-064 

ws  sw  5 

23760 

15 

0 

1  23775 

9102-116 

wssw6 

77040 

0 

0 

1  77040 

9102-118 

ws  sw  6 

77040 

45 

0 

1  77085 

9102-134 

ws  sw  6 

87120 

536 

0 

1  87656 

9102-143 

ws  sw  6 

91440 

506 

1 

1  91946 

ir-029 

ws  sw  6 

226800 

12 

0 

1  226812 

9102-068 

ws  sw  6 

15120 

14 

0 

1  15134 

9102-151 

ws  sw  7 

101520 

74 

0 

1  101594 

ir-212 

ws  sw  7 

180720 

428 

0 

1  181148 

ir-039 

ws  sw  7 

232560 

19 

0 

1  232579 

9102-110 

wssw8 

66960 

240 

0 

1  67200 

ir-033 

ws  sw  9 

228240 

75 

0 

1  228315 
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Appendix  B.l 

Tiiiie  Between  Fdluie  Anayisis—Bestfit  Fitted  Distribution  Statistics 


Air  Gateway  Software 


Function 

ChiiSaitsw 

Rank 

K-S  Test 

Rank 

A-D  Test 

Erluig(1.00.1.7Se+4) 

S.582109e-6 

2.0 

0.222222 

4.0 

4.131658 

EiaBB(1.7Sc+4) 

5^2109c-6 

3.0 

0.182179 

2.0 

0.346446 

Ganuna(0.72,2.44e+4) 

3.446969e-6 

1.0 

0.3S9468 

5.0 

5  563495 

Lognonnal(2.19e+4,5.31e+4) 

1.012304e-5 

5.0 

0.202314 

3.0 

0.309219 

WeibuU(0.86.1.62e+4) 

6.723445e-6 

4.0 

0.150171 

1.0 

0.220815 

Command  Post  Software 


Fiinctifwi 

Chi-Sainre 

Sank 

Ranic 

A-EL.Twt 

Eilang(l  .00,4.70e+4) 

3.0S8447o^ 

2.0 

0.3 

5.0 

8.28478 

Expoa(4.70e+4) 

3.(»58447e-6 

3.0 

0.214333 

3.0 

0.294565 

Ganima(0.76,6. 16e+ 4) 

1.280441e-6 

1.0 

0.3 

4.0 

8.653718 

Lognonnal(4.93e + 4. 8. 14e + 4) 

S.106247e-6 

5.0 

0.138725 

1.0 

0.164007 

WeibuU(0.93,4.54e+4) 

3.0791570-6 

4.0 

0.187344 

2.0 

0.242456 

Mission  Processor 


Fwi<;ti9n 

C.feSaws 

Rank 

K-S  Test 

Rank 

A-D  Test 

Erlang(1.00,6.09e+4) 

2.7731130-6 

4.0 

0.25 

5.0 

4.666643 

ExpoB(6.09et’4) 

2.7731130-6 

5.0 

0.232635 

3.0 

0.367737 

Gamma(  1 .2 1 ,5.02e+4) 

2.2484350-6 

2.0 

0.25 

4,0 

4.569653 

Lognonnal(6.25e+4,6.36e+4) 

1.6782320-6 

1.0 

0.168533 

1.0 

0.214114 

WeibulK  1.27,6.600+4) 

2.3395840-6 

3.0 

0.172211 

2.0 

0.268005 

AirSfiuioB  Softwaic 


Function 

Chi-Souaro 

Rank 

K-S  Test 

Rank 

A-D  Test 

Erlang(1.00,3.88e+4) 

1.2367850-5 

3.0 

0.375 

5.0 

10.64352 

Eipon(3A8e+4) 

1.236785C-5 

4.0 

0.199263 

1.0 

0.394123 

Ganuna(  1 .60,2 .42e+4) 

8.398407O-6 

2.0 

0.375 

4.0 

10.701525 

Lognonnal(4.09e+4,4.58o+4) 

1.3934450-5 

5.0 

0.23828 

3.0 

0.523748 

Weibull(  1.33.4.220+4) 

7.904357O-6 

1.0 

0.23713 

2.0 

0.417398 

MiuioB  Gatewiqr  Softwaie 


Function 

Chi-Square 

Rank 

K-S  Test 

Rank 

A-D  Test 

Erlang(1.00,1.89e+4) 

1.8236680-5 

4.0 

0.260789 

3.0 

14.338534 

ExpoB(1.89c+4) 

1.8236680-5 

5.0 

0.260789 

4.0 

2.516227 

Gamma(0.44,4.27e+4) 

1.2798960-5 

1.0 

0.970524 

5.0 

33.0914 

Lognormal(  1 .88e+4,4.23e+4) 

1.7672480-5 

3.0 

0.128473 

1.0 

0482263 

Weibull(0.7 1,1.490+4) 

1.6344640-5 

2.0 

0.154853 

2.0 

0.762252 

66 


Appendix  B.l  cont'd 


RA82  Disk  Olivet 


Function 

Cht-SW4f8 

Erlang(  1 .00^.50e+4) 

1. 75565  le-5 

EipMi(2.5«rt-4) 

1.75S651C-S 

Gainint(0.8S^.94e+4) 

1.2555540-5 

Lognonnal(3.37e+4,9.61e+4) 

2.2458170-5 

Weibull(0.83a.27e+4) 

1.5167550-5 

Stirius  Monitor  Softnrare 

Function 

Chi-Square 

ErlangC  1 .00^.7Se-t4) 

9.2540910-6 

EzpoB(2.75n-4) 

9.2840910-6 

Gainma(0.42,6.60e+4) 

5.1148830-6 

Lognonnal(2.7  le+4,6.24e-M) 

1.269260-5 

WeibuU(0.69a.l  le+4) 

8.3864920-6 

Woriatotion  Hardware 

Function 

Chi-Square 

Erlang(1.00,1.34e+5) 

5.1686150-6 

Expea(lJ4et-5) 

S.16861SC-6 

Gcinmt(  1 .00, 1 .34e+S) 

5.112760-6 

Lognormal(  1 .85e+5,4.6  le+5) 

5.8039850-6 

Weibull(0.94.1,30e+5) 

4.7365110-6 

Woriistation  Software 

EmsUPB 

Chi-Sauare 

Erlang(  1 .00,4.44e+4) 

7.7737320-6 

Expon(4.44c+4) 

7.7737320-6 

Gan]nui(0.85,S.2Se+4) 

5.447930-6 

Lognonnal(S.28e-M,l.l  le+3) 

7.357140-6 

Weibull(0.91.4.23e+4) 

6.0186480-6 

Eaak 

K-S  Tost 

Rank 

A-D  Test 

3.0 

0.333333 

5.0 

15.574513 

4.0 

0.177302 

3.0 

0.61115 

1.0 

0.333333 

4.0 

15.295113 

5.0 

0.127433 

2.0 

0.293634 

2.0 

0.111507 

1.0 

0.223854 

Rank 

K-S  Test 

Rank 

A-D  Test 

3.0 

0.328832 

3.0 

10.134119 

4.0 

0.328832 

4.0 

2.047664 

1.0 

0.894433 

5.0 

14.101811 

5.0 

0.157314 

1.0 

0.313377 

2.0 

0.205015 

2.0 

0.660556 

Rank 

K-S  Test 

Rank 

A-D  Test 

3.0 

0.321429 

5.0 

52.408995 

4.0 

0.080305 

1.0 

0.514415 

2.0 

0.321429 

4.0 

52.396768 

5.0 

0.169765 

3.0 

1.516917 

1.0 

0.097693 

2.0 

0.411985 

Rank 

K-S  Test 

Rank 

A-D  Test 

4.0 

0.297521 

4.0 

97.050801 

5.0 

0.12772 

3.0 

1.704748 

1.0 

0.322314 

5.0 

116.039477 

3.0 

0.121435 

2.0 

1.686172 

2.0 

0.091874 

1.0 

0.832917 
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Appendix  B.2 


MTTR  Analysis— BESTFIT  Fitted  Distribution  Statistics 


Air  Gatewagr  Software 


Chi-Souare 

K-S  Test 

Rank 

A-D  Test 

Expoii(27.50) 

0.028907 

1.0 

0.465185 

2.0 

10.876182 

Weibull(0.52,14.34) 

0.046498 

2.0 

0.3 

1.0 

8.526877 

LogiMniuri(1.02e+9«4^2e+18)  0^58347 

3.0 

0.529048 

3.0 

10.686175 

Conunand  Post  Software 

EimcMoa 

Chi-Souare 

Rank 

K-S  Test 

Rank 

A-D  Test 

Expon(22.80) 

0.01678 

1.0 

0.516127 

2.0 

11.517562 

Weibull(0.Sl,10.S6) 

0.025182 

2.0 

0.3 

1.0 

9.195967 

Lofnoniial(2.98et-8vSJ5e+l ')  0.18507 

3.0 

0.519814 

3.0 

10A23189 

Mission  Processor 

Function 

Chi-Souare 

Rank 

K-S  Test 

Rank 

A-D  Test 

Expon(1.61e+2) 

7.546136e-4 

1.0 

0.200297 

2.0 

1.223248 

WeibuIl(0.79,1.44e+2) 

1.119206e-3 

2.0 

0.167994 

1.0 

1.18008 

Lognonnal(4.88e+74.S3e+14)  0.024448 

3.0 

0.514479 

3.0 

3.019424 

Air  Mission  Software 

Function 

Chi-Souare 

Rank 

K-S  Test 

Rank 

A-D  Test 

Expon(33.00) 

0.017029 

1.0 

0.52675 

3.0 

15.457855 

Weibull(0.42,8.46) 

0.031602 

2.0 

0.333333 

1.0 

10.128038 

Losnonnri(5J4e+84.92e+18)  0.123322 

3.0 

0.518915 

2.0 

11.876528 

Mission  Gateway  Software 

Function 

Chi-Souare 

Rank 

K-S  Test 

Rank 

A-D  Test 

Expon(46.27) 

4.289477e-4 

1.0 

0.340329 

3.0 

8.592077 

Weibull(0.56,25.04) 

6.785464e-3 

2.0 

0.122088 

1.0 

2.525068 

Loanonna[(lA4e+4,7.79e+7) 

1  0.038165 

3.0 

0.229653 

2.0 

3318796 
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Appendix  B.2  cont'd 


RA82  Disk  Drives 

Function  Chi-Square 

Expon(3.52e+2)  2.200876e-3 

Weibull(1.24,3.78e+2)  2.25773e-3 

Losiioraul(3^7e+2^.04e^2)  2.925234c-3 


Status  Monitor  Software 

Fynctipn  Chi-Sauare 

Expon(43.94)  4.592955e-3 

Weibull(0.78.38.74)  4.820171e-3 

Losnoraud(1.44e+4«238e+7)  0.042251 


Woikstation  Haniware 

Function  Chi-Square 

Weibull(l. 04, 95.68)  1.853674e-3 

Expon(94.05)  1.938607e-3 

Lognonnal(S.97e+2,7.49e+3)  0.01304 

Workstation  Software 

Function  Chi-Square 

Weibull(0.80,61.32)  3.657444e-3 

Expon(71.49)  4.049147e-3 

Losnonnal(l.S3e+34.02e+5)  0.016114 


Rank 

K-S  Test 

Rank 

A-D  Test 

1.0 

0.117967 

1.0 

0.33531 

2.0 

0.148042 

3.0 

0.313863 

3.0 

0.127683 

2.0 

0.299404 

Rank 

K-S  Test 

Rank 

A-D  Test 

1.0 

0.205531 

2.0 

1.500284 

2.0 

0.155907 

1.0 

0.965251 

3.0 

0J00S48 

3.0 

2.176512 

Rank 

K-S  Test 

Rank 

A-D  Test 

1.0 

0.119126 

2.0 

0.844058 

2.0 

0.115707 

1.0 

0.964128 

3.0 

0.225565 

3.0 

6.472211 

Rank 

K-S  Test 

Rank 

A-D  Test 

1.0 

0.174032 

1.0 

6.390286 

2.0 

0.242755 

2.0 

9.340476 

3.0 

0.324028 

3.0 

16.761454 
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Appendix  C 

SLAM  n  MODEL  CODE 


GEN,BAUER,GRANSEN,l/7/1994,2,N,N,Y/Y,N,Y/l,72; 
LIMITS, 2, 6,400; 

SEEDS, 32849743 (9)  ; 


INTLC,XX(1)=0,XX(2)=0; 

INTLC,XX(20)=0,XX(21)=0,XX{22)=0,XX(23)=0; 

INTLC,XX(31)=0,XX(32)=0,XX(33)=0,XX(34)=0; 

INTLC,XX(55)=0,XX(54)=0,XX(53)=0,XX(52)=0,XX(51)=0,XX(50)=0; 

INTLC,XX(56)=0,XX(57)=0,XX(58)=0,XX(59)=0; 

INTLC,XX(65)=0,XX(64)=0,XX(63)=0,XX(62)=0,XX(61)=0,XX{60)=0; 

INTLC,XX(66)=0,XX{67)=0,XX{68)=0,XX(69)=0,XX(70)=0,XX(71)=0; 

INTLC,XX(9)=30000001,XX(10)=30000001,XX(11)=30000001; 

INTLC,XX(12)=30000001,XX(13)=30000001; 

INTLC,XX(72)=0,XX(73)=0,XX(74)=0,XX(75)=0,XX(76)=0; 

INTLC,XX(77)=0,XX(78)=0,XX(79)=0,XX(80)=0,XX(81)=0; 

INTLC,XX(85)=0,XX(82)=0,XX{83)=0,XX(a4)=0; 

INTLC,XX(100)=0,XX(102)=0,XX(104)=0,XX(106)=0,XX(108)=0,XX(110)=0; 

INTLC,XX{112)=0,XX(114)=0,XX(116)=0,XX(118)=0,XX(120)=0,XX(122)=0; 

INTLC,XX(124)=0; 

;  System  critical  failure  global  variables 
INTLC,XX(120)=0,XX{121)=0,XX(130)=0,XX(131)=0; 


;  Parametric  Analysis  Input  Variables 


INTLC,XX(200)=182784,XX(201)=161; 
INTLC,XX (202) =35000,XX (203) =28; 
INTLC,XX(204)=19124,XX(205)=46; 
INTLC,XX(206)=182784,XX(207)=161; 
INTLC,XX(208)=77520,XX(209)=33; 
INTLC, XX (210) =93986, XX (211) =23; 
INTLC, XX (212) =1058400, XX (213) =60; 
INTLC,XX(214)=1200000,XX{215)=60; 
INTLC,XX(216)=1051200,XX(217)=60; 
INTLC,XX(218)=250270,XX(219)=352; 
INTLC,XX(220)=82818,XX(221)=94; 
INTLC, XX (222) =44360, XX (223) =72; 
INTLC, XX (224) =137685, XX (225) =44; 


Gateway  hardware — MTBF,  MTTR 
Air  Gateway  Software 
Mission  Gateway  Software 
Mission  Processor  Hardware 
Air  Mission  Software 
Command  Post  Software 
Power  Distribution  Unit 
HSC  70  Controller 
Star  Coupler 
RA  82  Dislt  Drives 
Worlci  ation  Hardware 
Workstation  Software 
Status  Monitor  Software 


INTLC, XX ( 140) =0, XX ( 141) =0, XX ( 142) =0 
INTLC,XX(143)=0,XX(144)=0,XX(145)=0 
INTLC,XX(146)=0,XX(147)=0,XX(148)=0 
INTLC,XX(149)=0,XX(150)=0,XX(151)=0 
1NTLC,XX(152)=0,XX(153)=0,XX(154)=0 
INTLC,XX(155)=0,XX(156)=0,XX(157)=0 
INTLC,XX(158)=0,XX(159)=0,XX(160)=0 
INTLC,XX(161)=0,XX(162)=0,XX(163)=0 
INTLC, XX ( 164 ) =0, XX ( 165 ) =0, XX ( 166) =0 
INTLC, XX (167) =0; 

INTLC,XX(168)=0; 

INTLC,XX(169)=0; 

INTLC,XX(170)=0,XX(171)=0,XX(172)=0 
INTLC, XX (173) =0, XX (174) =0, XX ( 175) =0 
INTLC,XX(176)=0,XX(177)=0,XX(178)=0 


GW  Downtime  Counters 
AGW  Downtime  Counters 
MGW  Downtime  Counters 
MP  Downtime  Counters 
MP  Downtime  Counters 
AM  Downtime  Counters 
CP  Downtime  Counters 
SM  Downtime  Counters 
SM  Downtime  Counters 
RA82  Downtime  Counter 
ADOC  Downtime  Counter 
NCC  Downtime  Counter 
PDU  Downtime  Counters 
HSC  Downtime  Counters 
SC  Downtime  Counters 
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INTLC,XX(199)= 

TIMST,XX(50) ,# 
TIMST,XX(51) ,# 
TIMST,XX(57) ,# 
TIMST,XX(58) ,# 
TIMST,XX(59),# 
TIMST,XX(60) ,# 
TIMST,XX(52) ,# 
TIMST,XX{53) ,# 
TIMST,XX(54) ,# 
TIMST,XX(55) ,# 
TIMST,XX{56) ,# 
TIMST,XX(61) ,# 
TIMST,XX(62) ,# 
TIMST,XX(63),# 
TIMST,XX(64),# 
TIMST,XX(72) ,# 
TIMST,XX(73) ,# 
TIMST,XX(74),# 
TIMST,XX(75) ,# 
TIMST,XX(76) ,# 
TIMST,XX(71),# 
TIMST,XX{31) ,# 
TIMST,XX(32),# 
TIMST,XX(33) ,# 
TIMST,XX(34) ,# 
TIMST,XX(65) ,# 
TIMST,XX(66) ,# 
TIMST,XX(67),# 
TIMST,XX(68) ,# 
TIMST,XX(69),# 
TIMST,XX(70) ,# 


GWl  FAILURES; 
GW2  FAILURES; 
AIGW  FAILURES; 
A2GW  FAILURES; 
MIGW  FAILURES; 
M2GW  FAILURES; 
MPl  FAILURES; 
MP2  FAILURES; 
MP3  FAILURES; 
MP4  FAILURES; 
MP5  FAILURES; 
AMI  FAILURES; 
AM2  FAILURES; 
CPI  FAILURES; 
CP2  FAILURES; 
SMI  FAILURES; 
SM2  FAILURES; 
SM3  FAILURES; 
SM4  FAILURES; 
SMS  FAILURES; 
RA82  FAILURES; 
ADOC  HW  FAILS; 
ADOC  SW  FAILS; 
KCC  HW  FAILS; 
NCC  SW  FAILS; 
PDUl  FAILURES; 
PDU2  FAILURES; 
HSCl  FAILURES; 
HSC2  FAILURES; 
SCI  FAILURES; 
SC2  FAILURES; 


Upper  Bound  on 


System  Downtime 


TIMST,XX(1) ,#  HARDWARE  FAIL; 
TIMST,XX(2) ,#  SOFTWARE  FAIL; 
TIMST,XX(130) ,#  SYS  CRIT  FAIL; 

TIMST,XX(100) ,#  GW  CURR  FAILS; 
TIMST,XX(102) ,#AGW  CURR  FAILS; 
TIMST,XX(104) ,#MGW  CURR  FAILS; 
TIMST,XX(106) ,#  MP  CURR  FAILS; 
TIMST,XX(108) ,#  AM  CURR  FAILS; 
TIMST,XX(110) ,#  CP  CURR  FAILS; 
TIMST,XX(112) ,#PDU  CURR  FAILS; 
TIMST,XX(114) ,#HSC  CURR  FAILS; 
TIMST,XX(116) ,#  SC  CURR  FAILS; 
TIMST,XX(118),#RA82  CURR  FAILS; 
TIMST,XX(120) ,#ADOC  CURR  WSDN; 
TIMST,XX(122) ,#NCC  CURR  WSDN; 
TIMST,XX{124) ,#  SM  CURR  FAILS; 
TIMST,XX(131) ,#CURR  SYS  FAILS; 


TIMST,XX (140) , DOWNTIME  GWl; 
TIMST,XX(141) , DOWNTIME  GW2; 
TIMST,XX(142) ,DP  BD  DT  GW; 
TIMST, XX ( 143 ), DOWNTIME  AGWl; 
TIMST , XX ( 1 4  4 ) , DOWNTIME  AGW2 ; 
TIMST,XX(145) ,UP  BD  DT  AGW; 
TIMST,XX (146) , DOWNTIME  MGWl; 
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TIMST, XX ( 147 ), DOWNTIME  MGW2 
TIMST,XX(148) ,UP  BD  DT  MGW; 
TIMST, XX(149) .DOWNTIME  MPl; 
TIMST, XX(150) .DOWNTIME  MP2; 
TIMST.XX (151) .DOWNTIME  MP3; 
TIMST, XX (152) .DOWNTIME  MP4; 
TIMST, XX (153) .DOWNTIME  MP5; 
TIMST, XX (154) .UP  BD  DT  MP; 
TIMST, XX ( 155 ) , DOWNTIME  AMI ; 
TIMST, XX (156) .DOWNTIME  AM2; 
TIMST, XX ( 157 ), UP  BD  DT  AM; 
TIMST, XX (158) .DOWNTIME  CPI; 
TIMST, XX (159) .DOWNTIME  CP2; 
TIMST, XX (160), UP  BD  DT  CP; 
TIMST, XX (161) .DOWNTIME  SMI; 
TIMST, XX (162) .DOWNTIME  SM2; 
TIMST, XX(163) .DOWNTIME  SM3; 
TIMST, XX (164) .DOWNTIME  SM4; 
TIMST, XX (165) .DOWNTIME  SM5; 
TIMST, XX ( 166) , UP  BD  DT  SM; 
TIMST, XX (167), UP  BD  DT  RA82 
TIMST, XX (168), DP  BD  DT  ADO; 
TIMST, XX ( 169 ), UP  BD  DT  ACC; 
TIMST.XX (170) .DOWNTIME  PDUl 
TIMST.XX (171) .DOWNTIME  PDU2 
TIMST, XX ( 172 ), UP  BD  DT  PDU; 
TIMST, XX (173) .DOWNTIME  HSCl 
TIMST.XX (174) .DOWNTIME  HSC2 
TIMST, XX(175) , UP  BD  DT  HSC; 
TIMST.XX (176) .DOWNTIME  SCI; 
TIMST.XX ( 177 ) , DOWNTIME  SC2 ; 
TIMST, XX (178) .UP  BD  DT  SC; 

TIMST, XX ( 199) , DP  BD  DT  SYS; 

NETWORK; 

GATE/1,GW1F, , 1; 
GATE/2,GW2F,  .I.- 
GATE/S.MPIF,  ,1; 
GATE/4,MP2F,  .l.- 
GATE/S.MPSF,  ,1; 

GATE/ 6, MP4 F, , 1; 

GATE/7, MP5F, , 1; 

GATE/8,A1GWT,,1; 

GATE/9,A2GWT,,1; 

GATE/10,M1GWT,,1; 

GATE/11,M2GWT,,1; 

GATE/12,AM1T, ,1; 

GATE/13,AM2T,,1; 

GATE/14,CP1T,,1; 

GATE/15,CP2T,,1; 

GATE/16,PDD1,,1; 

GATE/17,PDU2,,1; 

GATE/18,  SCI,, 1; 

GATE/19,SC2,,1; 

GATE/20,HSC1,,1; 

GATE/2 1,HSC2,,1; 

GATE/22, RA82,,1; 

GATE/23, ADOC,,l; 


GATE/24, NCC,,1; 
GATE/25, SMIT, ,1; 
GATE/26, SM2T,,1; 
GATE/27,SM3T, ,1; 
GATE/28, SM4T,,1 ; 
GATE/29,SM5T,,1; 
GATE/30,SM1F, ,1; 
GATE/31, SM2F,,1; 
GATE/32, SM3F,,1; 
GATE/33,SM4F,,1; 
GATE/34,SM5F,  ,1; 
GATE/35,SYSCRT,,1; 


Failure  Simulation  Section 
Gateway  Hardware  Failures 


;  Segment  1 

CREATE,  ,,1,1,1; 

ACTIVITY; 

G1  GOON,l; 

ACTIVITY, EXPON (XX (200) ) ; 
ASSIGN,XX(50)=XX(50)+1,1; 
ASSIGN, XX ( 1 ) =XX ( 1 ) +1 , 1 ; 
ASSIGN,XX(100)=XX{100)+l,l; 
ASSIGN,ATRIB(3)=1,ATRIB(5)=1,1; 
ASSIGN, ATRIB { 4 ) =0, ATRIB ( 1 ) =TNOW 
ATRIB(6)*RLOGN(XX(201),50),1; 
ACTIVITY, , XX (100) .EQ.2,GCRC; 
ACTIVITY; 

GOON,l; 

CGI  CL0SE,GW1F, 1; 

ACTIVITY/1,ATRIB(6) ; 

0PEN,GW1F,1; 

ACTIVITY; 

ASSIGN, XX ( 100) =XX( 100) -1,1; 
ASSIGN,XX(140)=XX(140)+ATRIB(6)  , 
ACTIVITY, , ,GCRO; 

ACTIVITY, , ,G1; 

;  Segment  2 

CREATE,,, 1,1,1; 

ACTIVITY; 

G2  GOON,1; 

ACTIVITY, EXPON (XX (200) ) ; 
ASSIGN,XX(51)=XX(51)+1,1; 
ASSIGN,XX(1)=XX(1)+1,1; 
ASSIGN,XX(100)=XX(100)+1,1; 
ASSIGN,ATRIB(3)=2,ATRIB(5)=1,1; 
ASSIGN , ATRIB ( 4 ) =0 , ATRIB ( 1 ) =TNOW, 
ATRIB ( 6) =RLOGN (XX (201) , 50) ,  : 
ACTIVITY, , XX (100) .EQ.2,GCRC; 
ACTIVITY; 

GOON, 1; 


GWl  Failure  counter 
Hardware  Failure  Counter 
Current  GW  Failure  counter 
Marlcing  attributes — GWl,  GW 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  con^jon.  fail 
2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


GW2  Failure  counter 
Hardware  Failure  Counter 
Current  GW  Failure  counter 
Marking  attributes — GW2,  GW 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


73 


CG2  CLOSE, GW2F, 1; 

ACTIVITY/2,ATRIB(6) ;  Failure  Duration 

0PEN,GW2F, 1; 

ACTIVITY; 

ASSIGN, XX(100)=XX(100)-1, 1;  Decrement  curr  compon.  fail 

ASSIGN, XX(141)=XX(141) +ATRIB(6) ,2;  Increment  part  downtime 
ACTIVITY, , ,GCRO;  Send  to  Open  SYSCRT  gate 

ACTIVITY, , ,G2;  Recirculate  entity — next  fail 

GCRC  COLCT,ALL,#  GW  CRIT  FAIL,,2; 

ACTIVITY, ,, SYCC; 

ACTIVITY; 

ASSIGN, ATRIB(4)=4,1; 

ACTIVITY,, ATRIB (3) .EQ.1,CG1; 

ACTIVITY, , ,  CG2  ; 

GCRO  GOON,l; 

ACTIVITY, , ATRIB (4) .EQ.4,SYCO; 

ACTIVITY; 

COLCT,ALL,NONCRIT  GW, ,1; 

TERMINATE; 

9 

;  Air  Gateway  Software  Failures 

.■k-k******-k**-k*******-k****1r*-k**-k*-k**-k***-k*'k-k***-k-k**************-H,-H,-k** 


;  Segment  1 

CREATE,,, 1,1,1; 

ACTIVITY; 

AIGW  GOON,l; 

ACTIVITY, EXPON (XX(202)); 

ASSIGN,XX(57)=XX(57)+1,1;  Part  Failure  counter 

ASSIGN, XX(2)=XX(2)+1,1;  Software  Failure  Counter 

ASSIGN, XX(102)=XX(102)+1,1;  Current  GW  Failure  counter 

ASSIGN, ATRIB(3)=1,ATRIB(5}=2,1;  Marking  attributes— AGWl,  AGW 

ASSIGN, ATRIB ( 4 ) =0 , ATRIB ( 1 ) =TNOW, 

ATRIB(6) =RLOGN(XX (203) , 50) , 1;  Setting  failure  duration 

ACTIVITY, , XX (102) .EQ. 2, ACRC;  Send  to  close  SYSCRT  gate 

ACTIVITY; 

GOON,l; 

CAIG  CL0SE,A1GWT,1; 

ACTIVITY/3,ATRIB(6) ;  Failure  Duration 

0PEN,A1GWT,1; 

ACTIVITY; 

ASSIGN, XX(102)=XX(102) -1, 1;  Decrement  curr  compon.  fail 

ASSIGN,XX ( 143) =XX (143) +ATRIB (6) ,2;  Increment  part  downtime 
ACTIVITY, , ,ACRO;  Send  to  Open  SYSCRT  gate 

ACTIVITY, ,, AIGW;  Recirculate  entity — next  fail 

;  Segment  2 

CREATE, ,,1,1,1; 

ACTIVITY; 

A2GW  GOON,l; 

ACTIVITY, EXPON (XX(202)); 

ASSIGN,XX(58)=XX(58)+1,1; 

ASSIGN,XX(2)=XX(2)+1,1; 

ASSIGN, XX (102) =XX( 102) +1,1; 

ASSIGN,ATRIB(3)=2,ATRIB(5)=2,1; 


Part  Failure  counter 
Software  Failure  Counter 
Current  GW  Failure  counter 
Marking  attributes — AGW2,  AGW 


Mark  entity  as  critical  fail 
Send  entity  to  close  part  gate 
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AS  S I GN , ATRI B ( 4 ) »0 , ATRI B { 1 ) =TMOW 
ATRIB(6)=RLOGN(XX(203),50),1; 
ACTIVITY, , XX (102) .EQ.2,ACRC; 
ACTIVITY; 

GOON,l; 

CA2G  CLOSE,A2GWT,l; 

ACTIVITY/ 4 , ATRI B ( 6 ) ; 

OPEN  ,  A2GWT  ,  1  ; 

ACTIVITY; 

ASSIGN,XX(102)=XX{102)-1,1; 
ASSIGN,XX(144)*XX(144)+ATRIB(6) 
ACTIVITY, , ,ACRO; 

ACTIVITY, , ,A2GW; 


ACRC  COLCT,ALL,#  AGW  CRIT  FAIL,, 2; 
ACTIVITY, , , SYCC; 

ACTIVITY; 

ASSIGN,ATRIB(4)=4,1; 

ACTIVITY, ,ATRIB( 3) .EQ.1,CA1G; 
ACTIVITY, , , CA2G; 

ACRO  GOON,l; 

ACTIVITY, , ATRIB ( 4 ) . EQ . 4 , SYCO; 
ACTIVITY; 

COLCT,ALL,NONCRIT  AGW, ,1; 
TERMINATE; 


Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  coition,  fail 
2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Marie  entity  as  critical  fail 
Send  entity  to  close  part  gate 


Mission  Gateway  Software  Failures 


Segment  1 


CREATE,,, 1,1,1; 

ACTIVITY; 

MIGW  GOON,l; 

ACTIVITY, EXPON (XX (204) ) ; 
ASSIGN,XX(59)=XX(59)+1,1; 
ASSIGN, XX ( 2 ) =XX ( 2 ) +1 , 1 ; 

ASSIGN, XX ( 104 ) =XX ( 104 ) +1, 1 ; 
ASSIGN , ATRIB ( 3) =1 , ATRIB ( 5 ) =3, 1 ; 
ASSIGN, ATRIB (4) =0, 

ATRIB(6)=RLOGN(XX(205) ,50) ,  1; 
ACTIVITY, , XX (104) .EQ.2,MGCC; 
ACTIVITY; 

GOON,l; 

CMIG  CLOSE,MlGWT,l; 

ACTIVITY/5,ATRIB(6) ; 
OPEN,MlGWT,l; 

ACTIVITY; 

ASSIGN,XX(104)=XX(104)-1,1; 
ASSIGN, XX ( 146) =XX ( 146) +ATRIB ( 6) 
ACTIVITY, ,  ,MGCO; 

ACTIVITY, ,, MIGW; 


Part  Failure  counter 
Software  Failure  Counter 
Current  GW  Failure  counter 
Marking  attributes — MGWl,  MGW 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  coition,  fail 
2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Segment  2 

CREATE,,, 1,1,1; 
ACTIVITY; 
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M2GW  G00N,1; 

ACTIVITY, EXPON (XX (204) ) ; 

ASSIGN,XX(60)=XX(60)+1,1; 

ASSIGN,XX(2)=XX(2)+1,1; 

ASSIGN, XX (104) =XX( 104) +1,1; 
ASSIGN, ATRIB(3)=2,ATRIB(5)=3, 1; 
ASSIGN, ATRIB (4 )=0, 

ATRIB(6)=RLOGN(XX(205)  ,50)  ,1; 
ACTIVITY, , XX (104) .EQ.2,MGCC; 
ACTIVITY; 

GOON, 1; 

CM2G  CLOSE,M2GWT,l; 

ACTIVITY/6, ATRIB (6) ; 
OPEN,M2GWT,l; 

ACTIVITY; 

ASSIGN,XX(104)=XX(104)-1,1; 
ASSIGN,XX(147)=XX(147)+ATRIB(6) 
ACTIVITY, , ,MGCO; 

ACTIVITY, , ,M2GW; 


Part  Failure  counter 
Software  Failure  Counter 
Current  GW  Failure  counter 
Marlcing  attributes — MGW2,  MGW 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  conpon.  fail 
2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


MGCC  COLCT,ALL,#  MGW  CRIT  FAIL,, 2; 
ACTIVITY,,,SYCC; 

ACTIVITY; 

ASSIGN,ATRIB(4)=4,1; 

ACTIVITY, , ATRIB (3) .EQ.1,CM1G; 
ACTIVITY, ,,CM2G; 


MGCO  GOON,l; 

ACTIVITY,, ATRIB (4) .EQ.4,SYCO; 
ACTIVITY; 

COLCT,AiL,NONCRIT  MGW, ,1; 
TERMINATE; 


Mission  Processor  Hardware  Failures 


Segment  1 


CREATE,,, 1,1,1 ; 

ACTIVITY; 

MPl  GOON,l; 

ACTIVITY, EXPON (XX (206) ) ; 

ASSIGN,XX(52)=XX(52)+1,1; 

ASSIGN,XX(1)=XX(1)+1,1; 

ASSIGN,XX(106)=XX(106)+1,1; 

ASSIGN,ATRIB(3)=1,ATRIB(5)=4,1; 

ASSIGN, ATRIB (4 )=0, 

ATRIB(6)=RLOGN(XX(207)  ,50)  ,1; 
ACTIVITY,, XX (106) .EQ.5,MPCC; 
ACTIVITY; 

GOON,l; 

CMPl  CL0SE,MP1F,1; 

ACTIVITY/ 7 , ATRI B ( 6 ) ; 

OPEN,MPlF, 1; 

ACTIVITY; 

ASSIGN, XX ( 106) =XX( 106) -1,1; 
ASSIGN, XX ( 14 9 ) =XX ( 14 9 ) +ATRIB ( 6 ) 
ACTIVITY, , ,MPCO; 

ACTIVITY, , ,MP1; 


MPl  Failure  counter 
Hardware  Failure  Counter 
Current  MP  failure  counter 
Marlcing  attributes — MP1,MP 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  conpon.  fail 
2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 
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Segment  2 


CREATE, ,  ,1,1,1; 

ACTIVITY; 

MP2  GCX)N,1; 

ACTIVITY, EXPON (XX(206)); 
ASSIGN,XX(53)=XX(53)+1,1; 
ASSIGN,XX(1)=XX(1)+1,1; 
ASSIGN, XX ( 106) =XX( 106) +1, 1; 
ASSIGN,ATRIB(3)=2,ATRIB(5)=4, 
ASSIGN, ATRIB (4 )=0, 

ATRIB(6)=RLOGN(XX(207) ,50) 
ACTIVITY, , XX (106) .EQ.5,MPCC; 
ACTIVITY; 

GOON, 1; 

CMP2  CLOSE,MP2F,l; 

ACTIVITY/8, ATRIB (6) ; 
OPEN,MP2F,l; 

ACTIVITY; 

ASSIGN,XX(106)=XX(106)-1,1; 
ASSIGN, XX ( 150 )=XX( 150 )+ATRIB 
ACTIVITY, , ,MPCO; 

ACTIVITY, ,,MP2; 

;  Segment  3 

CREATE, ,,1,1,1; 

ACTIVITY; 

MP3  GOON,l; 

ACTIVITY, EXPON (XX (206) ) ; 
ASSIGN, XX ( 54 ) =XX ( 54 ) +1, 1 ; 
ASSIGN,XX(l)=XX(l)+l,l; 
ASSIGN,XX(106)=XX(106)+1,1; 
ASS IGN , ATRI B ( 3 ) =3 , ATRI B ( 5 ) =4 
ASSIGN, ATRIB (4) =0, 

ATRIB(6)=RLOGN(XX(207) ,50) 
ACTIVITY,, XX (106) .EQ.5,MPCC; 
ACTIVITY; 

GOON, 1; 

CMP3  CLOSE, MP3F,1; 

ACTIVITY/9,ATRIB(6) ; 
OPEN,MP3F,l; 

ACTIVITY; 

ASSIGN,XX(106)=XX(106)-1,1; 
ASSIGN, XX ( 151) =XX ( 151) +ATRIB 
ACTIVITY, , ,MPCO; 

ACTIVITY, , ,MP3; 

;  Segment  4 

CREATE, , ,1,1,1; 

ACTIVITY; 

MP4  GOON,l; 

ACTIVITY, EXPON (XX (206) ) ; 

ASSIGN,XX(55)=XX(55)+1,1; 

ASSIGN,XX(1)=XX(1)+1,1; 

ASSIGN,XX(106)=XX(106)+1,1; 

ASSIGN,ATRIB(3)=4,ATRIB(5)=4, 

ASSIGN, ATRIB (4)=0, 

ATRIB(6)=RLOGN(XX(207) ,50), 


Part  Failure  counter 
Hardware  Failure  Counter 
Current  MP  failure  counter 

1;  Marlcing  attributes — MP1,MP 

1;  Setting  failure  duration 

Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  compon.  fail 
(6), 2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


MPl  Failure  counter 
Hardware  Failure  Counter 
Current  MP  failure  counter 

,  1;  Marlcing  attributes — MP1,MP 

,  1;  Setting  failure  duration 

Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  compon.  fail 
(6), 2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Part  Failure  counter 
Hardware  Failure  Counter 
Current  MP  failure  counter 
1;  Marking  attributes — MP1,MP 

1;  Setting  failure  duration 


77 


ACTIVITY, , XX (106) .EQ.5,MPCC; 
ACTIVITY; 

GOON, 1; 

CMP4  CLOSE,MP4F,l; 

ACTIVITY/ 10, ATRIB (6) ; 
OPEN,MP4F,l; 

ACTIVITY; 

ASSIGN,XX(106)=XX(106)-1,1; 
ASSIGN, XX ( 152 ) =XX { 152 ) +ATRIB { 6) 
ACTIVITY, ,,MPCO; 

ACTIVITY, ,, MP4; 

;  Segment  5 

CREATE,,,  1,1,1; 

ACTIVITY; 

MP5  GOON,l; 

ACTIVITY, EXPON (XX (206) ) ; 
ASSIGN,XX(56)=XX(56)+1,1; 
ASSIGN, XX (1)=XX(1) +1,1; 

ASSIGN, XX (106) =XX( 106) +1,1; 
ASSIGN, ATRI B ( 3 ) =5 , ATRIB (5)=4,1; 
ASSIGN, ATRIB (4 )=0, 

ATRIB(6)=RLOGN(XX(207),50),1; 
ACTIVITY, , XX (106) .EQ.5,MPCC; 
ACTIVITY; 

GOON,l; 

CMP5  CLOSE, MP5F,1; 

ACTIVITY/ 1 1 , ATRIB ( 6 ) ; 
OPEN,MP5F,l; 

ACTIVITY; 

ASSIGN,XX(106)=XX(106)-1,1; 
ASSIGN,XX ( 153) *XX ( 153) +ATRIB ( 6) 
ACTIVITY, , ,MPCO; 

ACTIVITY, ,,MP5; 

MPCC  COLCT,ALL,#  MP  CRIT  FAIL, ,2; 
ACTIVITY,  ,  ,  SYCC; 

ACTIVITY; 

ASSIGN, ATRIB(4)=4, 1; 

ACTIVITY,, ATRIB (3) .EQ.1,CMP1; 
ACTIVITY, , ATRIB (3) .EQ.2,CMP2; 
ACTIVITY, , ATRIB (3) ,EQ.3,CMP3; 
ACTIVITY,, ATRIB (3) .EQ.4,CMP4; 
ACTIVITY, , ATRIB ( 3 ) . EQ . 5 , CMP5 ; 

MPCO  GOON,l; 

ACTIVITY, , ATRIB (4) .EQ.4,SYCO; 
ACTIVITY; 

COLCT,ALL,NONCRIT  MP,,1; 
TERMINATE; 


Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  compon.  fail 
2;  Incremen^  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Part  Failure  counter 
Hardware  Failure  Counter 
Current  MP  failure  counter 
Marking  attributes — MP1,MP 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  compon.  fail 
2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Entity  sent  to  close  part  gate 


;  Air  Mission  Software  Failures 


Segment  1 

CREATE,,, 1,1,1; 
ACTIVITY; 
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AMI  GOON,  IN¬ 
ACTIVITY,  EXPON  (XX  (208)  )  ; 
ASSIGN,XX(61)=XX(61)+1,1; 
ASSIGN,XX(2)=XX(2)+1,1; 
ASSIGN,XX(108)=XX(108) +1, 1; 
ASSIGN,ATRIB(3)=1,ATRIB(5)=5,1; 
ASSIGN, ATRIB(4)=0, 

ATRiB  ( 6)  =RLOGN  (XX  (209)  ,50) ,  In¬ 
activity,  ,  XX  (108)  .EQ.2,AMCC,- 
ACTIVITY; 

GOON, 1; 

cAMi  CLOSE, AMiT,  In¬ 
activity/ 12,  ATRiB(  6)  ,- 
0PEN,AM1T,1; 

ACTIVITY; 

ASSIGN,XX(108)=XX(108)-1,1; 
ASSIGN,XX(155)=XX(155)+ATRIB(6) 
ACTIVITY, ,  ,AMCO,- 
ACTIVITY, ,  ,AM1,- 

;  Segment  2 

CREATE,,,  1,1,  In¬ 
activity; 

AM2  GOON,  In¬ 
activity,  EXPON  (XX  (208)  )  ; 
ASSIGN,XX(62)=XX(62)+1,1,- 
ASSIGN,XX(2)=XX(2)+1,1; 
ASSIGN,XX(108)=XX(108)+1,1,- 
ASSIGN, ATRIB ( 3 ) =2 , ATRIB ( 5 ) =5, 1  ; 
ASSIGN, ATRIB(4)=0, 

ATRIB(6)=RLOGN(XX(209) ,50)  ,1; 
ACTIVITY, , XX  (108)  .EQ.2,AMCC,- 
ACTIVITY; 

GOON,1; 

CAM2  CLOSE, AM2T,1; 

ACTIVITY/13,  ATRIB (6) } 

OPEN,AM2T,  1; 

ACTIVITY; 

ASSIGN,XX(108)=XX(108)-1,1; 
ASSIGN,XX(156)=XX(156)+ATRIB(6) 
ACTIVITY, ,  ,AMCO,- 
ACTIVITY, ,  ,AM2,- 

AMCC  COLCT,ALL,#  AM  CRIT  FAIL,  ,2,- 
ACTIVITY,  , , SYCC; 

ACTIVITY; 

ASSIGN, ATRiB(4)  =4,  In¬ 
activity,,  ATRIB  (3)  .EQ.InCAMI; 
ACTIVITY, ,  ,CAM2,- 

AMco  GOON, In¬ 
activity,  , ATRIB ( 4 ) . EQ . 4 , SYCO; 
ACTIVITY; 

COLCT,ALL,NONCRIT  AM, ,1; 
TERMINATE; 


Part  Failure  counter 
Software  Failure  Counter 
Current  AM  failure  counter 
Marking  attributes — AMI,  AM 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  compon.  fail 
2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Part  Failure  counter 
Software  Failure  Counter 
Current  AM  Failure  counter 
Marking  attributes — AM2,  AM 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  conpon.  fail 
,2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Mark  entity  as  critical  fail 
Send  entity  to  close  part  gate 


Command  Post  Software  Failures 


79 


Segment  1 


CPI 


CCPl 


CP2 


CCP2 


CPCC 


CPCO 


CREATE, ,,1,1,1; 

ACTIVITY; 

GOON  1  * 

ACTIVITY, EXPON (XX (2 10) ) ; 
ASSIGN,XX(63)=XX(63)+1, 1; 

ASSIGN, XX(2)=XX(2)+1, l; 
ASSIGN,XX(110)=XX(110)+l,l; 
ASSIGN,ATRIB(3)=1,ATRIB(5)=6,1; 
ASSIGN, ATRIB (4) =0, 

ATRIB(6)=RLOGN(XX(211),50),1; 
ACTIVITY, , XX (110) .EQ.2,CPCC; 
ACTIVITY; 

GOON, 1 ; 

CLOSE, CP1T,1; 

ACTIVITY/ 1 4 ,  ATRI B ( 6 )  ; 

0PEN,CP1T,1; 

ACTIVITY; 

ASSIGN,XX(110)=XX(110)-1,1; 
ASSIGN, XX ( 158 ) =XX ( 158 ) +ATRIB ( 6) , 2 
ACTIVITY, ,,  CPCO; 

ACTIVITY, ,,  CPI; 

Segment  2 

CREATE, ,,1,1,1; 

ACTIVITY; 

GOON  1  * 

ACTIVITY, EXPON (XX (2 10) ) ; 

ASSIGN,XX(64)=XX(64)+1,1; 

ASSIGN,XX(2)=XX(2)+1,1; 

ASSIGN , XX (110 ) =XX (110 ) +1 , 1 ; 
ASSIGN,ATRIB(3)=2,ATRIB(5)=6,1; 
ASSIGN, ATRIB (4 )=0, 

ATRIB(6)=RLOGN{XX(211),50),1; 
ACTIVITY, , XX (110) .EQ.2,CPCC; 
ACTIVITY; 

GOON,l; 

CLOSE, CP2T, 1; 

ACTIVITY/15, ATRIB (6) ; 

OPEN,CP2T,l; 

ACTIVITY; 

ASSIGN,XX(110)=XX(110)-1,1; 
ASSIGN,XX(159)=XX(159)+ATRIB(6) ,2 
ACTIVITY, ,, CPCO; 

ACTIVITY, , , CP2 ; 

COLCT,ALL,#  CP  CRIT  FAIL, ,2; 
ACTIVITY,  ,  ,  SYCC; 

ACTIVITY; 

ASSIGN,ATRIB(4)=4,1; 

ACTIVITY, , ATRIB (3) .EQ.1,CCP1; 
ACTIVITY, , , CCP2 ; 

GOON,l; 

ACTIVITY, , ATRIB (4) .EQ.4,SYCO; 
ACTIVITY; 

COLCT,ALL,NONCRIT  CP,,1; 
TERMINATE; 


Part  Failure  counter 
Software  Failure  Counter 
Current  CP  Failure  counter 
Mar)cing  attributes — CPI,  CP 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  compon.  fail 
;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Part  Failure  counter 
Software  Failure  Counter 
Current  CP  Failure  counter 
Mar)cing  attributes — CP2,  CP 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  compon.  fail 
;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


80 


;  Status  Monitor  Software  Failures 


Segment  1 


CREATE, ,,1,1,1; 

ACTIVITY; 

SI  GOON,l; 

ACTIVITY, EXPON (XX (224) ) ; 
ASSIGN,XX(72)=XX{72)+1,1; 
ASSIGN, XX (2) =XX (2) +1,1; 

ASSIGN, XX ( 124 ) =XX ( 124 ) +1, 1 ; 
ASSIGN,  ATRIB  (3)  =1,  ATRIB  (5)  =7,  1; 
ASSIGN, ATRIB (4) =0, 

ATRIB(6)=RLOGN(XX(225),50),1; 
ACTIVITY,, XX (124) .EQ.5,SMCC; 
ACTIVITY; 

GOON,l; 

CSMl  CLOSE, SM1T,1; 

ACTIVITY/16, ATRIB(6) ; 
0PEN,SM1T,1; 

ACTIVITY; 

ASSIGN , XX ( 12 4 ) =XX ( 12 4 ) -1 , 1 ; 
ASSIGN, XX ( 161 ) =XX ( 161 ) +ATRIB (6) 
ACTIVITY, , , SMCO; 

ACTIVITY, ,, SI; 

;  Segment  2 


Part  Failure  counter 
Software  Failure  Counter 
Current  SM  failure  counter 
Marking  attributes — S1,SM 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  conqpon.  fail 
2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


CREATE, ,,1,1,1; 

ACTIVITY; 

S2  GOON  1 • 

ACTIVITY, EXPON (XX (224 ) ) ; 
ASSIGN,XX(73)=XX(73)+1,1; 
ASSIGN, XX (2) =XX (2) +1,1; 

ASSIGN, XX ( 124 ) =XX ( 124 ) +1, 1 ; 
ASSIGN, ATRIB ( 3 ) =2 , ATRIB (5)=7,1; 
ASSIGN, ATRIB (4) =0, 

ATRIB(6)=RLOGN(XX(225),50),1; 
ACTIVITY,, XX (124) .EQ.5,SMCC; 
ACTIVITY; 

GOON,l; 

CSM2  CLOSE,SM2T, 1; 

ACTIVITY/17, ATRIB (6) ; 
OPEN,SM2T,l; 

ACTIVITY; 

ASSIGN, XX (124) =XX( 124) -1,1; 
ASSIGN, XX ( 162 ) =XX ( 162 ) +ATRIB (6) 
ACTIVITY, , ,SMCO; 

ACTIVITY, ,,S2; 

;  Segment  3 


Part  Failure  counter 
Software  Failure  Counter 
Current  SM  failure  counter 
Marking  attributes — S2,SM 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  coition,  fail 
2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


CREATE,,, 1,1,1 ; 

ACTIVITY; 

S3  GOON,l; 

ACTIVITY, EXPON (XX (224) ) ; 
ASSIGN, XX(74)=XX(74)+1, 1; 
ASSIGN , XX ( 2 ) =XX ( 2 ) +1 , 1 ; 
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Part  Failure  counter 
Software  Failure  Counter 


ASSIGN, XX ( 124 )=XX( 124 )+l, 1; 

ASSIGN,ATRIB(3)=3,ATRIB(5)=7,1; 

ASSIGN,ATRIB(4)=0, 

ATRIB(6)=RLOGN(XX(225),50),1; 
ACTIVITY, , XX (124) .EQ.5,SMCC; 
ACTIVITY; 

GOON, 1; 

CSM3  CLOSE, SM3T,1; 

ACTIVITY/18,ATRIB(6) ; 
OPEN,SM3T,l; 

ACTIVITY; 

ASSIGN, XX(124)=XX(124)-1, 1; 
ASSIGN, XX ( 163 ) =XX ( 163 ) +ATRIB (6) 
ACTIVITY, , , SMCO; 

ACTIVITY, ,,  S3; 

;  Segment  4 

CREATE, ,,1,1,1; 

ACTIVITY; 

S  4  GOON  1 ’ 

ACTIVITY, EXPON {XX (224) ) ; 

ASSIGN,XX(75)=XX(75)+1,1; 

ASSIGN,XX(2)=XX(2)+1,1; 

ASSIGN,XX(124)=XX(124)+1,1; 

ASSIGN,ATRIB(3)=4,ATRIB(5)=7,1; 

ASSIGN, ATRIB (4 )=0, 

ATRIB(6)=RLOGN(XX(225),50),1; 
ACTIVITY,, XX (124) .EQ.5,SMCC; 
ACTIVITY; 

GOON, 1; 

CSM4  CLOSE,SM4T,l; 

ACTIVITY/ 19, ATRIB (6) ; 
OPEN,SM4T,l; 

ACTIVITY; 

ASSIGN, XX (124) =XX (124) -1,1; 
ASSIGN, XX ( 164 ) =XX ( 164 ) +ATRIB (6) 
ACTIVITY, , ,SMCO; 

ACTIVITY, , ,S4; 

;  Segment  5 

CREATE, ,,1,1,1; 

ACTIVITY; 

S5  GOON,l; 

ACTIVITY, EXPON (XX (224) ) ; 
ASSIGN,XX(76)=XX(76) +1, 1; 
ASSIGN,XX(2)=XX(2)+1,1; 

ASSIGN, XX ( 124 )=XX( 124) +1,1; 
ASSIGN, ATRIB (3) =5, ATRIB (5) =7,1; 
ASSIGN, ATRIB(4)=0, 

ATRIB(6)=RLOGN(XX(225),50),1; 
ACTIVITY, , XX (12 4) .EQ.5,SMCC; 
ACTIVITY; 

GOON, 1; 

CSM5  CLOSE,SM5T, 1; 

ACTIVITY/20,ATRIB{6) ; 
OPEN,SM5T,l; 

ACTIVITY; 

ASSIGN, XX (124) =XX( 124) -1,1; 


Current  SM  failure  counter 
Marking  attributes — SM3,SM 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  con^Jon.  fail 
,2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Part  Failure  counter 
Software  Failure  Counter 
Current  SM  failure  counter 
Marking  attributes — S4,SM 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  compon.  fail 
,2;  Increment  part  downtime 
Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Part  Failure  counter 
Software  Failure  Counter 
Current  SM  failure  counter 
Marking  attributes — S5,SM 

Setting  failure  duration 
Send  to  close  SYSCRT  gate 


Failure  Duration 


Decrement  curr  compon.  fail 
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ASSIGNjXX (165) =XX ( 165) +ATRIB (6) , 2;  Increment  part  downtime 
ACTIVITY, , , SMCO; 

ACTIVITY, ,,S5; 

SMCC  COLCT,ALL,#  SM  CRIT  FAIL,, 2; 

ACTIVITY, , ,SYCC; 

ACTIVITY; 

ASSIGN,ATRIB(4)=4,1; 

ACTIVITY, ,ATRIB (3) .EQ.1,CSM1; 

ACTIVITY, ,ATRIB(3) .EQ.2,CSM2; 

ACTIVITY, ,ATRIB (3) .EQ.3,CSM3; 

ACTIVITY, , ATRIB ( 3 ) . EQ . 4 , CSM4 ; 

ACTIVITY, , ATRIB ( 3 ) . EQ . 5 , CSM5 ; 

SMCO  GOON,l; 

ACTIVITY, ,ATRIB (4) .EQ.4,SYCO; 

ACTIVITY; 

COLCT,  ALL, NONCRIT  SM, , I ; 

TERMINATE; 

• -klt-k-kifk  ■k-Ifk'ti-k-k*****  ******  **-k-k***-k -klUfk-liirmflt -kit  ******  ************  ■kiHt**  *** 

;  RA82  Dislc  Drive  Failures 


CREATE,,, 1,1,1; 

ACTIVITY,,, R82 ; 

CREATE,,,1,1,1; 

ACTIVITY, ,,R82; 

CREATE,,, 1,1,1; 

ACTIVITY,,, R82; 

CREATE,,, 1,1,1; 

ACTIVITY, ,,R82; 

CREATE, ,,1,1,1; 

ACTIVITY, , , R82 ; 

CREATE,,, 1,1,1; 

ACTIVITY,,, R82; 

CREATE,,,1,1,1; 

ACTIVITY,,,R82; 

CREATE, ,,1,1,1; 

ACTIVITY,,, R82; 

CREATE,,, 1,1,1; 

ACTIVITY, ,,R82  ; 

CREATE,,,1,1,1; 

ACTIVITY, , , R82 ; 

R82  GOON,l; 

ACTIVITY, EXPON (XX (2 18) ) ; 
ASSIGN,XX (71) =XX (71) +1, 1; 
ASSIGN,XX(1)=XX(1)+1,1; 
ASSIGN, XX ( 118) =XX( 118) +1,1; 
ASSIGN,ATRIB(5)=8,1; 


RA82  Total  Failure  counter 
Hardware  Failure  Counter 
Current  RA82  Failure  counter 
Marking  attribute — RA82  fail 


Send  to  Open  SYSCRT  gate 
Recirculate  entity — next  fail 


Entity  sent  to  close  part  gate 
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ASSIGN, ATRIB (4 )=0, 

ATRIB(6)=RLOGN(XX(219),50),1;  Setting  failure  duration 
ACTIVITY, , XX(118) .GE. 3, RAC;  Critical  failure — close  gates 

ACTIVITY; 

R82A  GOON,l; 

ACTIVITY/21,ATRIB(6) ;  Failure  Duration 

ASSIGN, XX(118)=XX(118)-1, 1;  Decrement  curr  shadow  set  fail 

ACTIVITY, ,, RAO; 

ACTIVITY, ,, R82 ;  Recirculate  entity — next  fail 

RAC  COLCT,ALL,#  RA82  CRIT  FAIL,, 2; 

ACTIVITY, , ,SYCC;  Send  to  close  SYSCRT  gate 

ACTIVITY; 

CLOSE, RA82, 1;  Close  component  gate 

ASSIGN, ATRIB(4)=4,1;  Mark  entity  as  critical  fail 

ACTIVITY, , , R82A; 

RAO  GOON, 2; 

ACTIVITY, ,XX(118) .LE.2.AND.ATRIB(4) .EQ.4,SYCO; 

ACTIVITY,, XX (118) .LE. 2. AND. ATRIB (4) .EQ.4,OPRA; 

ACTIVITY; 

COLCT, ALL, NONCRIT  RA82 ,  ,  1 ; 

TERMINATE; 

OPRA  OPBN,RA82,l; 

TERMINATE; 

•★♦★★★★★★★★★★★★★★★★★‘^★★★★★★★★★★★★************************************ 

9 

;  ADOC  Workstation  Failures 

.******★******★*************★★***★***•*********************★********** 


;  ADOC  Hardware  Failures 

CREATE,,, 1,1,1; 

ACTIVITY, , ,AHW; 

CREATE, ,,1,1,1 ; 

ACTIVITY, , ,AHW; 

CREATE, ,, 1,1,1 ; 

ACTIVITY,,,AHW; 

CREATE,,, 1,1,1; 

ACTIVITY, , ,AHW; 

CREATE, ,,1,1,1; 

ACTIVITY, , ,AHW; 

CREATE, ,,1,1,1 ; 

ACTIVITY, , ,AHW; 

AHW  GOON,l; 

ACTIVITY, EXPON (XX (220) ) ; 
ASSIGN,XX(31)=XX(31)+1,1; 
ASSIGN, XX (1)=XX(1) +1, l; 
ASSIGN,XX(120)=XX(120)+l,l; 
ASSIGN, ATRIB (5) =9,  ATRIB (3)=1,1; 
ASSIGN, ATRIB (4 )=0, 

ATRIB(6)=RLOGN(XX(221) ,50),1; 
ACTIVITY; 

ADOF  GOON,l; 


ADOC  Hardware  Failure  counter 
SYS  Hardware  Failure  counter 
Current  ADOC  Failure  counter 
Marking  attributes — ADOC  fail 

Setting  failure  duration 


ACTIVITY,, XX ( 120 ) .GE. 4, CADO;  Critical  failure— close  gates 

ACTIVITY; 

ADOA  GOON,l; 

ACTIVITY/22, ATRIB (6) ;  Failure  Duration 

ASSIGN, XX(120)=XX(120)-1, 2;  Decrement  curr  WS  down 

ACTIVITY,,, CADO; 

ACTIVITY, , ATRIB (3) .EQ.1,AHW;  Recirc  entity— next  HW  fail 

ACTIVITY, , ATRIB (3) .EQ. 2, ASW;  Recirc  entity — next  SW  fail 

CADC  COLCT,ALL,#  ADOC  CRITFAIL,,2; 

ACTIVITY, ,,SYCC;  Send  to  close  SYSCRT  gate 

ACTIVITY; 

CLOSE, ADOC,  1;  Close  coiqponent  gate 

ASSIcaT,ATRIB(4)=4, 1;  Mark  entity  as  critical  fail 

ACTIVITY, , ,ADOA; 

CADO  GOON  2  # 

ACTIVITY,, XX (120) .LB.3.AND.ATRIB(4) .EQ.4,SYCO; 

ACTIVITY,, XX (120) .LE. 3. AND. ATRIB (4) .EQ.4,QADO; 

ACTIVITY; 

COLCT,ALL,NONCRIT  ADOC,,l; 

TERMINATE; 

OADO  OPEN, ADOC,  1;  Re-open  Coioponent  gate 

TERMINATE; 

;  ADOC  Software  Failures 

CREATE,,, 1,1,1; 

ACTIVITY, , ,ASW; 

CREATE,,, 1,1,1; 

ACTIVITY, , ,ASW; 

CREATE,,, 1,1,1; 

ACTIVITY,  ,  ,  ASW; 

CREATE,,,1,1,1; 

ACTIVITY, , ,ASW; 

CREATE,,, 1,1,1; 

ACTIVITY, ,  ,ASW; 

CREATE,,, 1,1,1; 

ACTIVITY, ,  ,ASW; 


ASH  GOON,l; 

ACTIVITY, EXPON (XX (222) ) ; 

ASSIG>N,XX(32)  =XX (32) +1, 1;  ADOC  Software  Failure  counter 

ASSIGN,XX(2)=XX (2) +1, 1;  SYS  Software  Failure  counter 

ASSIGN, XX (120) ™XX (120) +1, 1;  Current  ADOC  Failure  counter 

ASSIGN,ATRIB(5)b9,ATRIB(3)=‘2,  1;  Marking  attributes — ADOC  fail 

ASSIGN,ATRIB(4)«0, 

ATRIB(6)=RLOGN(XX(223) ,50) ,1;  Setting  failure  duration 

ACTIVITY, , ,ADOF; 

f*********r***********-tr-k-it**-lt  *******  *********  ****** 

;  NCC  Workstation  Failures 

f ******************************************************************** 
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NCC  Hardware  Failures 


CREATE,,, 1,1,1, 
ACTIVITY, ,  ,NHIf, 

CREATE,,,  1,1,1, 
ACTIVITY, , ,NHW, 

CREATE, ,,1,1,1, 
ACTIVITY, ,  ,NHir, 

CREATE,,, 1,1,1, 
ACTIVITY, , ,NHW 

CREATE,,,  1,1,1, 
ACTIVITY, ,  ,innr 

CREATE, ,, 1, 1, 1 
ACTIVITY, , ,NHM 

CREATE, ,, 1, 1, 1 
ACTIVITY, , ,NHW 

CREATE, ,, 1, 1, 1 
ACTIVITY,  ,  ,1IHII 

CREATE, ,, 1, 1, 1 
ACTIVITY, , ,Nfflf 


NHW  G00N,1; 

ACTIVITY, EXPON (XX (220) ) ; 
ASSI(aj,XX(33)»XX(33)+l,l; 

ASSIGN , XX ( 1 ) *XX ( 1 ) +1 , 1 ; 

ASSIGN,  XX  ( 122 )  =XX  ( 122 )  -t-l,  1 ; 

ASSIGN,ATRIB(5)«10,ATRIB(3)=1,1; 

ASSI(ar,ATRIB(4}»0, 

ATRIB ( 6 ) «RLOGN (XX ( 22 1 ) , 50 ) , 1 ; 
ACTIVITY; 

NCCF  GOON,l; 

ACTIVITY, ,XX(122).GE.3, CNCC ; 
ACTIVITY; 

NCCA  GOON,l; 

ACTIVITY/23,ATRIB(6) ; 

ASSIGN, XX ( 122 ) =XX ( 122 ) -1, 2 ; 
ACTIVITY, , ,CNCO; 

ACTIVITY, ,ATRIB (3) .EQ.1,NHW; 
ACTIVITY,  ,ATRIB (3)  .EQ.2,NSW; 


NCC  Hardware  Failure  counter 
SYS  Hardware  Failure  counter 
Current  NCC  Failure  counter 
Marking  attributes — NCC  fall 

Setting  failure  duration 


Critical  failure — close  gates 


Failure  Duration 
Decrement  curr  WS  down 

Reclrc  entity — next  HW  fall 
Recirc  entity — next  SW  fall 


CNCC  COLCT,ALL,#  NCC  CRIT  FAIL,, 2; 
ACTIVITY,,, SYCC; 

ACTIVITY; 

CLOSE, NCC, 1; 

ASSIQI,ATRIB  (4 )  =4,1; 

ACTIVITY, ,  ,NCCA; 


Send  to  close  SYSCRT  gate 

Close  component  gate 

Mark  entity  as  critical  fail 


CNCO  GOON, 2; 

ACTIVITY,, XX (122) .LE.2.AND.ATRIB(4) .EQ.4,SYCO; 
ACTIVITY,, XX (122) .LE.2.AND.ATRIB(4) .EQ.4,ONCC; 
ACTIVITY; 

COLCT,ALL,NONCRIT  NCC,,1; 


TERMINATE; 

ONCC  OPEN,NCC, 1;  Re-open  Conponent  gate 

TERMINATE; 

;  NCC  Software  Failures 

CREATE, ,,1,1, 1; 

ACTIVITY, , ,NSW; 

CREATE,,, 1,1,1; 

ACTIVITY, , ,NSW; 

CREATE,,, 1,1,1; 

ACTIVITY, ,, NSW; 

CREATE,,, 1,1,1; 

ACTIVITY, , ,NSW; 

CREATE,,, 1,1,1; 

ACTIVITY, , ,NSW; 

CREATE,,, 1,1,1; 

ACTIVITY, , ,NSW; 

CREATE,,, 1,1,1; 

ACTIVITY, , ,NSW; 

CREATE, ,,  1, 1, 1; 

ACTIVITY,,,  NSW; 

CREATE,,,  1,1,1; 

ACTIVITY,,, NSW; 

NSW  GCX)N,1; 

ACTIVITY, EXPON {XX (222) ) ; 

ASSIGN,XX(34)*XX(34)+1,1;  NCC  Software  Failure  counter 

ASSIGN, XX (2 )=XX (2) +1,1;  SYS  Software  Failure  counter 

ASSIGN, XX (122 )=XX( 122) +1,1;  Current  NCC  Failure  counter 

ASSIcai,ATRIB(5)=10,ATRIB(3)=2,l;  Marking  attributes—NCC  fail 
ASSIGN, ATRIB (4) »0, 

ArRIB(6)=RL0QJ(XX(223)  ,50) ,1;  Setting  failure  duration 

ACTIVITY, , ,NCCF; 

•*★★**♦★★★★***★★♦★**♦★★★**★*****♦*★♦****★★♦*♦★★*★******♦***♦♦*★♦**♦♦★ 

;  System  Critical  Failure  Smnmary  Section 
•  ★★*★***★★******★*★★★★*★★•*■***■*■****★*********★***♦**★★★**************■*■ 

SYCC  COLCT,ALL,SYS  CRIT  CLZ  CT,,1; 

ACTIVITY; 

ASSIGN,XX(130)=XX(130)+1,XX(131)=XX(131)+1,1;  Counters 

ACTIVITY,, NNGAT( 38) .EQ.0,SCLZ; 

ACTIVITY, , ,T1; 

SCLZ  COLCT, ALL, ENTITYCLZGATE, , 1 ; 

ACTIVITY; 

CLOSE, SYSCRT,!; 

ACTIVITY; 

T1  TERMINATE; 

SYCO  COLCT, ALL, SYS  CRIT  OPN  CT,,1; 

ACTIVITY; 
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ASSIQI,  XX  ( 1 3 1 ) -XX  ( 1 31 )  - 1 , 

XX(199)-XX(199)+ATRIB(6),1;  Upper  Bound  SYS  Downtime 
ACTIVITY,, XX (131) .EQ.O,SOPN; 

ACTIVITY,,, T2; 

SOPN  COLCT, ALL, ENTITYOPNGATE, , 1 ; 

ACTIVITY; 

OPEN,SYSCRT,l; 

ACTIVITY; 

T2  GOON,l; 

ACTIVITY, , ATRIB ( 5 ) . EQ . 1 , XGM ; 

ACTIVITY,  ,ATRIB( 5)  .EQ.2,XAGIf; 

ACTIVITY,,  ATRIB (5) .BQ.3,XMGW; 

ACTIVITY,,  ATRIB (5) .EQ.4,XMP; 

ACTIVITY,, ATRIB (5)  .EQ.S,XAM; 

ACTIVITY,,  ATRIB (5) .BQ.6,XCP; 

ACTIVITY,, ATRIB (5)  .EQ.7,XSM; 

ACTIVITY,, ATRIB (5) .EQ.8,XRA8; 

ACTIVITY,, ATRIB (5) .BQ.9,XADO; 

ACTIVITY,, ATRIB (5) .EQ.10,XNCC; 

ACTIVITY,,  ATRIB (5) .EQ.ll,XPDa; 

ACTIVITY, ,ATRIB( 5) .BQ.12,XHSC; 

ACTIVITY, ,ATRIB( 5) .EQ.12,XSC; 

XGH  COLCT, ALL, GH  SYCO,,l; 

ASSIGN,  XX  ( 142 )  -XX  ( 142 )  -fATRIB  ( 6) ,  1  ; 

TERMINATE; 

XAGW  COLCT, ALL, AGV  SYCO,,l; 

ASSI^, XX  ( 145) -XX  ( 145) +ATRIB  ( 6)  ,  1; 

TERMINATE; 

XMGW  COLCT, ALL, MGW  SYCO,,l; 

ASSIGN, XX  ( 148 ) -XX  ( 148 )  4-ATRIB  ( 6) ,  1; 

TERMINATE; 

XMP  COLCT, ALL,MP  SYCO,,l; 

ASSIGN, XX ( 154 ) -XX ( 154 ) +ATR1B (6) , 1; 

TERMINATE; 

XAM  COLCT, ALL, AM  SYCO,,l; 

ASSIGN,XX ( 157 ) -XX (157 ) +ATRIB (6) , 1; 

TERMINATE; 

XCP  COLCT, ALL, CP  SYCO,,l; 

ASSI®l,XX  (160)  -XX  (160)  +ATRIB  (6) ,  1; 

TERMINATE; 

XSM  COLCT, ALL, SM  SYCO,,l; 

ASSIGN, XX ( 166) -XX (166) +ATRIB (6) , 1; 

TERMINATE; 

XRA8  COLCT, ALL, RA82  SYCO,,l; 

ASSIGN, XX ( 167 ) -XX ( 167 ) +ATRIB ( 6) ,  1 ; 

TERMINATE; 

XADO  COLCT, ALL, ADOC  SYCO,,l; 

ASSIGN, XX  ( 168 ) -XX  ( 168 ) -t-ATRIB  ( 6)  ,  1 ; 

TERMINATE; 

XNCC  COLCT, ALL, NCC  SYCO,,l; 

ASSI(^,XX  ( 169) -XX  (169) -t-ATRIB (6) ,  1; 

TERMINATE; 

XPDU  COLCT, ALL, PDD  SYCO,,l; 

TERMINATE; 

XHSC  COLCT, ALL, HSC  SYCO,,l; 

TERMINATE; 

XSC  COLCT, ALL, SC  SYCO,,l; 

TERMINATE; 
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Granite  Sentry  Air  and  Missile  Message  Processing  Section 


;  Air  and  Missile  Message  Creation 

AMSG  CREATE,UNFRM(5,10) ,,1,,1; 

ACTIVITY; 

Ml  ASSI(ai,XX(l)>=XX(l)+l,ATRIB(2)»l; 

ACTIVITY, ,, GW; 

MMSG  CREATE, RNOBM(30, 2),, 1,,1; 

ACTIVITY; 

M2  ASSIGN,XX(2)»XX(2)+1,ATRIB(2)»2; 

ACTIVITY,,, GW; 

§ 

/ 

;  Gateway  Hardware  Segment 

GW  GOON,l; 

ACTIVITY,, NNGAT(l) .EQ.0,GW1; 

ACTIVITY, , NNGAT (2 ) . EQ . 0, GW2 ; 

ACTIVITY, , ,MNRG; 

GWl  C0LCT,ALL,GW1  MSG; 

ACTIVITY,,, GWS; 

GW2  COLCT,ALL,GW2  MSG; 

ACTIVITY, , , GWS; 

MNRG  COLCT,ALL,MSG  NR  GATEWAYS; 

ACTIVITY, ,, COUNT; 

• -kit  **  ir -k*  ir-kit** ‘k'k****-k  it  it -k*  it*  ******* -kit -k-k******  it  it  *********  it 

;  Gateway  Software  Segment 

GWS  GOON, 1; 

ACTIVITY, ,ATRIB(2) .EQ.1,AGW; 

ACTIVITY, ,ATRIB (2) .EQ.2,MGW; 

m  ******************************************************************** 
f 

;  GW-Air  Gateway  Software — Air  Messages 

AGW  GOON,l; 

ACTIVITY,, NNGAT (8) .EQ.0,A1R; 

ACTIVITY, , NNGAT ( 9 ) . EQ . 0 , A2R; 

ACTIVITY, , ,AGWN; 

AIR  C0LCT,ALL,A1GW  MSG; 

ACTIVITY,  ,  ,MP; 

A2R  COLCT,ALL,A2GW  MSG; 

ACTIVITY, ,  ,MP; 

AGWNR  COLCT,ALL,MSG  NR  AGW,1; 

ACTIVITY,,, COUNT; 

********************************************************************* 
;  GW-Mission  Gateway  Software — Missile  Messages 

MGW  GOON,l; 

ACTIVITY, , NNGAT ( 1 0 ) . EQ . 0 , MWIR; 

ACTIVITY,, NNGAT (11) .EQ.0,MW2R; 
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ACTIVITY, , ,MGWN; 

MHIR  COLCT,ALL,MlGir  MSG; 

ACTIVITY, ,  ,MP; 

MH2R  C0LCT,ALL,M2GMt  MSG; 

ACTIVITY, ,  ,MP; 

MGHNR  COLCT,ALL,MSG  NR  MGH; 

ACTIVITY,,,COUNT; 

.***★****★**************************★********♦★********************** 
;  Mission  Processors — Hardware 

MP  GOON,l; 

ACTIV1TY,,NNGAT(3) .EQ.0,MP1R; 

ACTIVITY,,NMGAT(4) .EQ.0,MP2R; 

ACTIVITY,, NNGAT (5) .EQ.0,MP3R; 

ACTrVITY,,NNGAT(6)  .EQ.0,MP4R; 

ACTIVITY,, NNGAT (7) .BQ.0,MP5R; 

ACTIVITY, ,  ,MPNR; 

MPIR  COLCT,ALL,MPl  MSG,,1; 

ACTIVITY, ,  ,MPSW; 

MP2R  COLCT,ALL,MP2  MSG,,1; 

ACTIVITY, , ,MPSW; 

MP3R  COLCT,ALL,MP3  MSG,,1; 

ACTIVITY, ,  ,MPSW; 

MP4R  COLCT,ALL,MP4  MSG,,1; 

ACTIVITY, ,  ,MPSW; 

MP5R  COLCT,ALL,MP5  MSG,,1; 

ACTIVITY, ,  ,MPSW; 

MPNR  COLCT,ALL,MSG  NR  M  PRCX:ESS; 

ACTIVITY,,, COUNT; 

f  hi,***  *■!,****  **********1,-k-k1fk1r  ****************  ***■11*  ***********  ********* 

;  Mission  Processor  Software  Segment 

MPSH  GOON, 1; 

ACTIVITY, ,ATRIB (2) .EQ.1,AMMP; 

ACTIVITY, , ATRIB ( 2 ) . EQ . 2 , CPMP ; 

j************** ************************************************  ****** 

;  MP-Air  Mission  Software — Air  Messages 

AMMP  GOON,l; 

ACTIVITY, , NNGAT ( 12 ) . EQ . 0 ,  AMIR; 

ACTIVITY,, NNGAT (13)  .EQ.0,AM2R; 

ACTIVITY, ,  ,AMNR; 

AMIR  C0LCT,ALL,AM1MP  MSG; 

ACTIVITY, , , PDU; 

AM2R  COLCT,ALL,AH2MP  MSG; 

ACTIVITY, , , PDU; 

AHNR  COLCT,ALL,MSG  NR  AMMP; 

ACTIVITY,,, COUNT; 

•  *★★***★★★**★★**★*★★♦★★♦*★♦**★*******♦**♦★♦**★*♦*★*★■*■**★*♦***♦**★**** 
;  MP-Coimnand  Post  Software — Missile  Messages 

CPMP  GOON,l; 

ACTIVITY,, NNGAT (14) .EQ.0,CP1R; 

ACTIVITY,, NNGAT (15) .EQ.0,CP2R; 
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ACTIVITY, ,,CPNR; 

CPIR  C0LCT,ALL,CP1MP  MSG; 

ACTIVITY, , , PDU; 

CP2R  C0LCT,ALL,CP2MP  MSG; 

ACTIVITY, , , PDU; 

CPNR  COLCT,ALL,MSG  NR  CPMP; 

ACTIVITY, , , COUNT; 

•**«**★*★***★***«***★***«*★******************«*****«*****'*********«** 
. -klUHfk***************************** ********************** i, it **1,** **■*■!,* 

;  Power  Distribution  Unit  Segment 
PDU  GOON  1  * 

ACTIVITY,, NNGAT( 16) .EQ.0,PD1; 

ACTIVITY,, NNGAT( 17) .EQ.0,PD2; 

ACTIVITY,,, PDUNR; 

PDl  COLCT, ALL, PDUl  MSG; 

ACTIVITY,,, SC; 

PD2  COLCT, ALL, PDU2  MSG; 

ACTIVITY,,, SC; 

PDUNR  COLCT, ALL,MSG  NR  PDU; 

ACTIVITY,,, COUNT; 

>******************************************************************** 

********************************************************************* 

;  Star  Coupler  Segment 
SC  GOON,l; 

ACTIVITY, , NNGAT ( 18 ). EQ. 0, SCI ; 

ACTIVITY, , NNGAT ( 19 ) . EQ . 0, SC2 ; 

ACTIVITY,,, SCNR; 

SCI  COLCT, ALL, SCI  MSG; 

ACTIVITY,,, HSC; 

SC2  COLCT, ALL, SC2  MSG; 

ACTIVITY, ,, HSC; 

SCNR  COLCT, ALL,  MSG  NR  SC; 

ACTIVITY,,, COUNT; 

.************************************************************** -kit  I, 

. ******************************************************************** 

;  HSC  70  Segment 
HSC  GOON,l; 

ACTIVITY,, NNGAT (20) .EQ.0,H1; 

ACTIVITY,, NNGAT (21) .EQ.0,H2; 

ACTIVITY, , ,HSCNR; 

HI  COLCT, ALL, HSCl  MSG; 

ACTIVITY, ,, RAl; 

H2  COLCT, ALL, HSC2  MSG; 

ACTIVITY,,, RAl; 

HSCNR  COLCT,ALL,MSG  NR  HSC; 

ACTIVITY,,, COUNT; 

********************************************************************* 
. ******************************************************************** 

;  RA82  Disk  Drive  Segment 
RAl  GOON,l; 

ACTIVITY,, NNGAT (22) .EQ.0,R1; 

ACTIVITY,,, RANR; 
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R1  COLCT,ALL,RA82  MSG; 

ACTIVITY,,, PRCES; 

RANR  COLCT,ALL,MSG  NR  RA82; 

ACTIVITY, , , COUNT; 

f  ***■!>********  ■k******-tfk*****1flr*****'k********ii***********1i***-li-lfk**-k**** 

;  Messages  Received  Count — total,  air,  and  missile 

.**iHtir*iflfk*'ti***ir*****iHt****it***************************************** 

r 

PRCES  COLCT, BET, TOTAL  MSG  REC'D,,1; 

ACTIVITY, ,ATRIB (2) .EQ.1,AIRR; 

ACTIVITY, ,ATRIB (2) .EQ.2,MISS; 

AIRR  COLCT, ALL, AIR  REC'D; 

ACTIVITY, , ,ADOC; 

MISS  COLCT, ALL,MISSILE  REC'D; 

ACTIVITY, , ,ADOC; 

.********  ■k-*****-ik************-it*****************  *************  ********** 

;  Messages  Not  Received  Count — Total#  Air#  Missile 

# 

COUNT  COLCT, ALL, TOTAL  MSG  NR,1; 

ACTIVITY,  ,ATRIB (2)  .EQ.1,ANR; 

ACTIVITY,, ATRIB (2) .EQ.2,MISN; 

ANR  COLCT,ALL,AIR  MSG  NR; 

ACTIVITY, , ,MNR; 

MISNR  COLCT,ALL,MISSILE  MSG  NR; 

ACTIVITY, , ,MNR; 

MNR  TERMINATE; 

;  ADOC  Workstations  Segment 
ADOC  GOON,l; 

ACTIVITY,, NNGAT (23) .EQ.0,ADR; 

ACTIVITY, ,  ,ADONR; 

ADR  COLCT,ALL,ADOC  MSG; 

ACTIVITY, , ,NCC; 

ADONR  COLCT,ALL,MSG  NR  ADOC,l; 

ACTIVITY,,, NCC; 

.******************************************************************** 

.******************************************************************** 

, 

;  NCC  Workstations  Segment 
NCC  GOON,l; 

ACTIVITY,, NNGAT (24) .EQ.0,N1; 

ACTIVITY, ,,NCCNR; 

N1  COLCT, ALL, NCC  MSG; 

ACTIVITY; 

TERM; 

NCCNR  COLCT,ALL,MSG  NR  NCC,1; 

ACTIVITY; 

TERM; 

.  ******************************************************************** 
•  ******************************************************************** 

;  Granite  Sentry  Status  Message  Processing  Section 

.******************************************************************** 
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•★♦♦♦★★*■**♦♦*♦♦*★*****★*******♦*★★****♦***♦**♦**♦***♦★★*♦**★♦♦******* 


;  Status  Hessage  Creation 

CREATE,  5,,  1,,1; 

ACTIVITY; 

ASSIQI, XX  ( 85 ) -X>. '  85) +1 ; 

ACTIVITY, , ,  SK:?':; 

.★************** .»*****************♦********************************* 

;  Status  Honltor  Software  Section 
.**♦*********♦*******■********************♦********★****♦************* 


SMSW  GCX)N,1; 

ACTIVITY,, MNGAT (25) .EQ.0,SM1; 
ACTIVITY, , NNGAT  (26) . EQ.  0,  SM2  ; 
ACTIVITY,, MMGAK 27)  .EQ.0,SM3; 
ACTIVITY,, NMGAT( 28) .EQ.0,SM4; 
ACTIVITY,, NKGAT (29) .EQ.0,SM5; 
ACTIVITY,,,  SMNR; 

SMI  GCXm,!; 

ACTIVITY,, NNGAT (30) .EQ.0,G1A; 
ACTIVITY,, NNGAT (26) .EQ.0,SM2; 
ACTIVITY,, NNGAT (27) . EQ.O, SMB.- 
ACTIVITY,  ,NNGAT  (28)  .EQ.0,SM4; 
ACTIVITY, , NNGAT (29) , EQ. 0,  SM5; 
ACTIVITY,,, SMNR; 

SM2  GOON  1  * 

ACTIVITY,, NNGAT (31) .EQ.0,G2A; 
ACTIVITY,, NNGAT (27)  . EQ.O, SMB.- 
ACTIVITY, ,  NNGAT  (28)  .EQ.0,SM4,- 
ACTIVITY,,NNGAT(29)  .EQ. 0, SMB.- 
ACTIVITY, ,,  SMNR; 

SM3  GCX}N,  1,- 

ACTIVITY,  , NNGAT ( 32 ) . EQ . 0 ,  G3A; 
ACTIVITY, , NNGAT  (28).EQ.0,SM4,- 
ACTIVITY,, NNGAT (29) .EQ.0,SM5; 
ACTIVITY,,, SMNR; 

SM4  GOON,  1,- 

ACTIVITY,,  NNGAT  (33)  .EQ.0,G4A,- 
ACTIVITY,, NNGAT (29)  .EQ.O, SMB.- 
ACTIVITY,  , , SMNR; 

SM5  GOON,l; 

ACTIVITY,, NNGAT (34)  .EQ.0,G5A,- 
ACTIVITY,,,SMNR; 


GIA  GOON,l; 

ACTIVITY,  ,ATRIB(1)  .GE.XX(9)  ,G1B,- 
ACTIVITY,,,SM1M; 

G2A  GOON,l; 

ACTIVITY,,ATRIB(1) .GE.XX (10) ,G2B; 
ACTIVITY,,,  SM2M; 
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G3A  G00N,1; 

ACTIVITY, ,ATRIB(1) .GE.XX(ll) ,G3B; 

ACTIVITY, , ,  SM3M; 

G4A  G00N,1; 

ACTIVITY, ,ATRrB(l) .GE.XX(12) ,G4B; 

ACTIVITY, , , SM4M; 

G5A  G00N,1; 

ACTIVITY, ,ATRIB(1) .GE.XX(13) ,G5B; 

ACTIVITY, , ,  SM5M; 

.************ A****************************** ********* <*★************* 

;  Status  Monitor  Software  Message-Based  Failures 

.1Hfk*iflt1flt*-tt*******  it*************  ***1111***********************  ********* 


;  Message  Based  Software  Failures — SMI  Segment 

GIB  GOON, 2; 

ACTIVITY; 

ACTIV1TY,,,SMSW; 

ASSIGN, XX (77 ) -XX ( 77 ) +1 , XX ( 9 )  =ATRIB ( 1) +50, 1 ; 
CLOSE, SM1F,1; 

ACTIVITY/24, RLOGN( 50, 50) ; 

0PEN,SM1F,1; 

TERMINATE; 

;  Message  Based  Software  Failures — SM2  Segment 

G2B  GOON, 2; 

ACTIVITY; 

ACTIVITY, , , SMSW; 

ASSIGN,XX(78)=XX(78)+1,XX(10)-ATRIB(1)+50,1; 
CLOSE, SM2F,1; 

ACTIVITY/25, RLOGN(50, 50) ; 

OPEN,SM2F,l; 

TERMINATE; 

;  Message  Based  Software  Failures — SM3  Segment 

G3B  GOON, 2; 

ACTIVITY; 

ACTIVITY, , , SMSW; 

ASSIGN,XX(79)=XX(79)+1,XX|11)=ATRIB(1)+50,1; 

ACTIVITY; 

CLOSE, SM3F,1; 

ACTIVITY/26, RLOGN (50, 50) ; 

OPEN,SM3F,l; 

ACTIVITY; 

TERMINATE; 

;  Message  Based  Software  Failures — SM4  Segment 

G4B  GOON, 2; 

ACTIVITY; 

ACTIVITY  SMSW ' 

ASSIGN, XX ( 80 ) =XX ( 8 0 ) +1 , XX ( 12 ) -ATRIB ( 1 ) +60 , 1 ; 
ACTIVITY; 

CLOSE,SM4F,l; 

ACTIVITY/27, RLOGN(50, 50) ; 
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OPEN,  SM4F,  IN¬ 
ACTIVITY; 

TERMINATE; 

;  Message  Based  Software  Failures — SMS  Segment 

G5B  GOON, 2; 

ACTIVITY; 

ACTIVITY, , ,  SMSW; 

ASSIGN, XX ( 8 1 ) =XX < 8 1 ) +1 , XX ( 13 )  =ATRIB ( 1 ) +60 , 1 ; 
ACTIVITY; 

CLOSE, SM5F,1; 

ACTIVITY/28, RLOGN{50,50) ; 

OPEN,  SM5F,  In¬ 
activity; 

TERMINATE; 

SMIM  COLCT,ALL,SMl  MSG, ,1; 

ACTIVITY,,, SMR; 

SM2M  COLCT,ALL,SM2  MSG,,1; 

ACTIVITY,,,  SMR; 

SM3M  COLCT,ALL,SM3  MSG,, IN¬ 
ACTIVITY,  , ,  SMR; 

SM4M  COLCT,ALL,SM4  MSG,, IN¬ 
ACTIVITY, ,,  SMR; 

SM5M  COLCT,ALL,SM5  MSG,  ,1; 

ACTIVITY, , ,  SMR; 


SMR  COLCT, ALL, STATUS  MSG  REC’D,,1; 

ACTIVITY; 

TERMINATE; 

SMNR  COLCT, ALL,  STATUS  MSG  NR; 

ACTIVITY; 

TERMINATE; 

. ********************************************* *********************** 
e 

END; 

INITIALIZE,, 200000, Y; 

FIN; 
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Appendix  D 

SENTRY  Spreadsheet  Availability  Model 


Model  Availability  of  eiitii«  Series  System 

A(t)  =  A1  •  A2  •  A3  •  •  A13  Note:  There  are  13  critical  components  in  die  model 


HW  SW  HW 

250270  82818  44360  82816 


s 


col 


m 


<M 


I 


^  NO 
00  fn 


Soo 

eo 


•3  5g 


cs 


9  S 

r>^ 


SfM 
00 


s 

s 

On 


VO 


S8 

ON 

SO 


00 


s 

<s 


o 

<s 

o 


^  Os  ^  ^ 


<s 


C4 

SO 

Os 


s 


o 


ca  O 


<s 


Os  r«* 
1^  fs 


58  S 


"  lO 
SO 


m  00 

OS  W 


y%  •-« 
^  On 


$s 

1^  t*- 


ss 


r** 

«N 


On 

09 


8 

I? 

r*- 


r*- 

00 


On 

ro 

Os 

r«- 


o 

Os 

SO 

y> 

o 

y^ 


On 

?C! 

On 


Si 

VO 


ON 

<s 


CnI 

cs 


00 

y^ 


os 

«A 

%r\ 

00 


$ 


«n 

»A 

<s 


00 

f<>  so 


^  '*0-  NA 

^  C«l 


»A  — 
NO  OS 


PS 


^  fA 

t  s 

^  o 

ON 

00  VO 
«A  VO 


2S 


00 
<s 
00 


s 

fs 


ri 

«A 


«»s 

NA 


fA 


*-•00  Q 

^  rr  5 


o> 

o> 


Appendix  F.l 


System  Avg  Downtime  Analysis-pcr  1,000,000  minutes 


Spreadsheet  model  with  same  center  pts  suggests 
avg  system  downtime  per  1,000,000  minutes  =  7.422 
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Appendix  F.  2 


System  Avg  Critical  Failure  Analysis—pcr  1,000,000  minutes 


Spreadsheet  modd  widi  same  center  pts  suggests 
avg  #  system  failures  per  1,000,000  minutes  -  .080806 
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Appendix  F.3 

SpKcdsheet  AviUablllty  Model  RimtlBie  ConpartMm  Statiittcf 


0.99999258 


Appendix  F.4 


95%  Confidence  Intervals— 

using  10-run  averages  to  calculate  the  standard  error  of  the  mean 

Y-axes  reflect  mean  downtimes 
X-axes  reflect  number  of  runs  averaged 


Runtime  Group:  2  million  minutes 


10  IS  20  25  30 
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Appendix  F.4  cant’d 
Runthne  Groiq):  10  nuUkMi  mimites 


10  IS  20  25  30 


Runtime  Group:  20  million  minutes 


10  IS  20  25  30 


Runtime  Group;  30  million  minutes 


Appendix  F.  5 


Standard  Error  of  the  DifiFerences— 
using  10-run  averages  to  calculate  the  standard  error  of  the  difference 

Y-axes  reflect  mean  downtimes 
X-axes  reflect  number  of  runs  averaged 


Runtime  Group;  2  million  minutes 


Runtime  Group;  5  million  minutes 
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Appendix  F.5  cont'd 
Runtime  Group;  10  million  minutes 


Runtime  Group;  20  million  minutes 


Runtime  Group;  30  million  minutes 


106 


Appendix  F.  6 

Critical  Faihre  Aaalyais-Staadard  Error  of  the  Mcaas  Plots 


Appendix  F.7 


95%  Confidence  Intervals- 

using  10-run  averages  to  calculate  the  standard  error  of  the  mean 

Y-axes  reflect  mean  number  of  critical  failures 
X-axes  reflect  number  of  runs  averaged 


Runtime  Group:  2  million  minutes 


10  IS  20  2S  30 


Runtime  GtXMip;  5  million  minutes 


10  IS  20  25  30 
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Appendix  F.8 

Standard  Error  of  the  Dififeroices- 
using  10-run  avoages  as  a  baseline 

Y-axes  reflect  mean  number  of  critical  Mures 
X-axes  reflect  nuinbo*  of  runs  averaged 


Runtime  Group:  2  million  minutes 


Runtime  Group:  5  million  minutes 
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EXPERIMENTAL  DESIGN  POINTS  USED  IN  RSM  ANALYIS  OF  THE  EFFECT  OF 
ELIMINATION  OF  PART  REDUNDANCY  ON  SYSTEM  DOWNTIME 
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